Hello, 

I’m trying figure out if the mapping is wrong or if it is the permissions that are wrong. I’m going to use my specific use case to illustrate my problem.

I want to set up Traefik with Crowdsec which need the Traefik logs to work, but unfortunately I can’t seem to do it in the correct way. I have to admit that this is not my forte, to put it bluntly I’m a noob. I’m using Unraid with docker containers so no docker compose. I like to use the containers because it has been easy for me to wrap my head around and I really like the dropdown were I reach shortcuts to important functions by clicking on the apps icon. My installation of Traefik is based on Ibracorps instruction and is since Monday updated to the latest version and Traefik appears to more or less run as a clock (I have an unrelated warning in the logs that I’ll try to fix when I’m done with this). I also looked at Ibracorps old clip for Crowdsec, Jims garage and techno Tims which is for the updated version of Traefik and his Crowdsec installation to find some guidance. 

I installed CrowdSec and added a path to /var/log/traefik:

Name: Traefik Logs

Container Path: /var/log/traefik/

Host Path: /mnt/user/appdata/traefik/logs/

I also created a path in Traefik:

Name: Logs

Container Path: /var/log/traefik/

Host Path: /mnt/user/appdata/traefik/logs/

To make the logs from traefik accessible for CrowdsSec you have specify the file path::

log:

  level: "INFO"

  filePath: "/var/log/traefik/traefik.log"

accessLog:

  filePath: ”/var/log/traefik/access.log"

If I’m understanding it correctly this places the logs in /var/log/traefik. But after the restart when I ls in to the /var/log/traefik there are no files (and nothing in the /logs folder in Traefik, and the access to the logs from the dropdown is gone, as in Dozzle.

When I’m instead did it like this, just to see if it would work:

Name: Logs

Container Path: /logs

Host Path: /mnt/user/appdata/traefik/logs

And change accordingly in the traefik.yaml:

log:

  level: "INFO"

  filePath: ”/logs/traefik.log"

accessLog:

  filePath: "/logs/access.log"

It produces logs in the referenced folder, but tas above I loose access to the logs via the dropdown. After that I’ve tried a lot permutations of this; removed the paths and then added them back in (it’s a lot of restarts).

I also have of course added per instruction the path in acquis.yaml, but obviously it will not find anything:

"No matching files for pattern /var/log/traefik/*"

So I get feeling that I doing a stupid, stupid noob misstake with the paths or it might be a permission issue (how would I fix that in /var/log/?). What I want to accomplish is just to make Traefiks logs accessible to CrowdSec without breaking the link to the logs in Traefiks dropdown (and in Dozzle). There is something I’m missing and I hope someone would like to help me a bit…

Best regards

On 4/6/2026 at 1:37 PM, Smib666 said:

If I’m understanding it correctly this places the logs in /var/log/traefik. But after the restart when I ls in to the /var/log/traefik there are no files (and nothing in the /logs folder in Traefik, and the access to the logs from the dropdown is gone, as in Dozzle.

Do any logs actually appear in /mnt/user/appdata/traefik/logs when traefik is running? Ff you dont see logs in this folder on the host, crowdsec wont see any either if you cant.

What you are doing looks correct at a first glance. Paths look like I would expect.

Edited April 7Apr 7 by MowMdown

10 minutes ago, MowMdown said:

Do any logs actually appear in /mnt/user/appdata/traefik/logs when traefik is running? Ff you dont see logs in this folder on the host, crowdsec wont see any either if you cant.

What you are doing looks correct at a first glance. Paths look like I would expect.

Thanks @MowMdown for your reply. It kind of appears to have solved itself. I got annoyed and shut down CrowdSec and watched TV with my dog for couple of hours and decided to look at Traefiks log. It was there, out of the blue. Like it needed time to realign the paths. So I started CrowdSec today when I got home and it seems to work according to the log. I’ll try to finish the install tomorrow. lessoned learned sometimes things just need a little time.😉

On 4/7/2026 at 10:14 PM, MowMdown said:

Do any logs actually appear in /mnt/user/appdata/traefik/logs when traefik is running? Ff you dont see logs in this folder on the host, crowdsec wont see any either if you cant.

What you are doing looks correct at a first glance. Paths look like I would expect.

Hey,

So I was happy too soon. I knew it. It would’ve been to easy.

I just wanted to try an idea before I finished the installation of CrowdSec and added a port to Traefik. Well, it crashed. When I restarted it and began the continuation of the install of CrowdSec I just couldn’t get CrowdSecs GUI to connect. So I started to check logs and I realized that CrowdSec had lost the connection to the Traefik logs. Why? So I looked in static yaml, and for some unholy reason it had reverted back to the ”original” settings I had before I wanted to connect with CrowdSec. So I changed it back to:

log:

  level: "INFO"

  filePath: "/var/log/traefik/traefik.log"

accessLog:

  filePath: ”/var/log/traefik/access.log"

And made sure that the path in Traefik was:

Name: Logs

Container Path: /var/log/traefik/

Host Path: /mnt/user/appdata/traefik/logs/

And so I waited, patiently. No logs from Traefik. And for some reason I no longer had permission to edit the acquis.yaml in CrowdSec. So to make sure I uninstalled everything to do CrowdSec and restarted the server. Still no logs. Can there be a permission issue somewhere? I’m starting to wonder if I should remove the Traefik folder in /var log/ and create a new one. Unfortunately I’m not CLI user and I don’t use Linux commands unless I have the full string to copy and paste. And doing things in /var/log/ does make me nervous. If you think this would be a good idea to make a new folder for the Traefik logs I really would appreciate if you could help me with that. I attach a screenshot from when I ”ls -l” into /var/log/ if you can see anything wrong.

This is very confusing. Any idea or suggestion is highly appriciated.

Best regards

The host path /var/log has nothing to do with those containers assuming the mappings you specified above.

9 hours ago, trurl said:

The host path /var/log has nothing to do with those containers assuming the mappings you specified above.

Hello, thanks for the reply. Would you kindly clarify. What do you mean by ”has nothing do with those containers”. Do you mean that there is nothing wrong with the Traefik folder in /var/log/ or that the paths are wrong?

You should probably be asking these questions in the Support thread for the Docker in question. You can find this by left-clicking on the Docker Icon on the DOCKER tab of the GUI and picking '?Support' from the dropdown list.

EDIT: One of the reasons for Containers to use the appdata Share is so that the configuration files and any necessary container data files can have their own permissions governed by the requirements of the Container.

Edited April 9Apr 9 by Frank1940

16 hours ago, Smib666 said:

Hey,

So I was happy too soon. I knew it. It would’ve been to easy.

I just wanted to try an idea before I finished the installation of CrowdSec and added a port to Traefik. Well, it crashed. When I restarted it and began the continuation of the install of CrowdSec I just couldn’t get CrowdSecs GUI to connect. So I started to check logs and I realized that CrowdSec had lost the connection to the Traefik logs. Why? So I looked in static yaml, and for some unholy reason it had reverted back to the ”original” settings I had before I wanted to connect with CrowdSec. So I changed it back to:

log:

  level: "INFO"

  filePath: "/var/log/traefik/traefik.log"

accessLog:

  filePath: ”/var/log/traefik/access.log"

And made sure that the path in Traefik was:

Name: Logs

Container Path: /var/log/traefik/

Host Path: /mnt/user/appdata/traefik/logs/

And so I waited, patiently. No logs from Traefik. And for some reason I no longer had permission to edit the acquis.yaml in CrowdSec. So to make sure I uninstalled everything to do CrowdSec and restarted the server. Still no logs. Can there be a permission issue somewhere? I’m starting to wonder if I should remove the Traefik folder in /var log/ and create a new one. Unfortunately I’m not CLI user and I don’t use Linux commands unless I have the full string to copy and paste. And doing things in /var/log/ does make me nervous. If you think this would be a good idea to make a new folder for the Traefik logs I really would appreciate if you could help me with that. I attach a screenshot from when I ”ls -l” into /var/log/ if you can see anything wrong.

This is very confusing. Any idea or suggestion is highly appriciated.

Best regards

traefik writes logs to /mnt/user/appdata/traefik/logs/ not the host's own /var/log/... You're looking in the wrong spot.

Edited April 9Apr 9 by MowMdown

16 hours ago, trurl said:

The host path /var/log has nothing to do with those containers assuming the mappings you specified above.

In fact, the containers have no access to /var/log since it isn't mapped. That's sort of the whole point of dockers, they can't get to anything you don't specify in the mappings.

You can examine the logs at the mapped host path

17 hours ago, Smib666 said:

Host Path: /mnt/user/appdata/traefik/logs/

So I kind of figured out why this messes me up.

1: I do not use docker compose.

2: When I compare how the logs volumes are defined in Ubuntu vs Unraid they do look different. In Ibrocorps docker compose for Traefik there are no volume for logs, they are insted defined like this:

# Logging
- --log.level=INFO
- --accesslog=true

and in the static configuration the logs are just defined like this:

log:
level: INFO
format: json
accessLog:
format: json

3. By default Unraid containers store their logs in /var/lib/docker/containers/ and when I look in some of my other containers none of them have the log volumes defined in the container gui.

4. I can get logs in the folder for Traefik by creating a folder /logs:

Name: Logs

Container Path: /logs

Host Path: /mnt/user/appdata/traefik/logs

And change accordingly in the traefik.yaml:

log:

level: "INFO"

filePath: ”/logs/traefik.log"

accessLog:

filePath: "/logs/access.log"

But that means that the logviewer in th dropdown under the Traefik logo looses the connection to the logs (and so do Dozzle) because I guess they are set up to fetch the logs from /var/lib/docker/containers? And isn't a point to not have the logs stored in the Traefik folder?

I havent solved it yet and I wouldn't try do do this but I want to use CrowdSec and it needs the Traefik logs. If someone has a clever idea how to do so without breaking the connection to the built in logviewer I would very much apriciate it.

Best regards

Edited April 10Apr 10 by Smib666

So I’ve solved it, with a lot of help from Loz over at CrowdSecs Discord. I’ll describe the solution here in case if someone finds themselves in the same situation.

So how to make the logs from Traefik accessibly for CrowdSec as docker containers? Well, thanks to Loz I realised how a competent piece of software CrowdSec is. It can read logs directly from stdout. So first give CrowdSec access to the dockers by create a path to /var/run/docker.sock in the container GUI. Then you change the acquis.yaml, in my case Traefik to this:

source: docker

container_name:

- traefik

label: traefik

Or you can use labels like Traefik. You can read about it here:

https://docs.crowdsec.net/docs/next/log_processor/data_sources/docker

I’ve not finalised the install yet but the logs look ok. I’m trying to get the dashboard to connect to its database, but there is a permission issue I’ll have solve. Probably is it yet another Unraid speciality. But CrowdSec can read the logs of Traefik. Not bad for a noob if I may say so myself.