Version: v1.3.4

Crowdsec configuration

CrowdSec has a main yaml configuration file, usually located in /etc/crowdsec/config.yaml.

Configuration example#

Default configuration

common:  daemonize: true  pid_dir: /var/run/  log_media: file  log_level: info  log_dir: /var/log/  log_max_size: 500  log_max_age: 28  log_max_files: 3  compress_logs: true  working_dir: .config_paths:  config_dir: /etc/crowdsec/  data_dir: /var/lib/crowdsec/data/  simulation_path: /etc/crowdsec/simulation.yaml  hub_dir: /etc/crowdsec/hub/  index_path: /etc/crowdsec/hub/.index.json  notification_dir: /etc/crowdsec/notifications/  plugin_dir: /var/lib/crowdsec/plugins/crowdsec_service:  acquisition_path: /etc/crowdsec/acquis.yaml  #acquisition_dir: /etc/crowdsec/acquis/  parser_routines: 1  buckets_routines: 1  output_routines: 1cscli:  output: human  hub_branch: wip_lapidb_config:  log_level: info  type: sqlite  db_path: /var/lib/crowdsec/data/crowdsec.db  #max_open_conns: 100  #user:  #password:  #db_name:  #host:  #port:  flush:    max_items: 5000    max_age: 7dapi:  client:    insecure_skip_verify: false    credentials_path: /etc/crowdsec/local_api_credentials.yaml  server:    log_level: info    listen_uri: 127.0.0.1:8080    profiles_path: /etc/crowdsec/profiles.yaml    use_forwarded_for_headers: false    console_path: /etc/crowdsec/console.yaml    online_client: # Crowdsec API      credentials_path: /etc/crowdsec/online_api_credentials.yaml#    tls:#      cert_file: /etc/crowdsec/ssl/cert.pem#      key_file: /etc/crowdsec/ssl/key.pemprometheus:  enabled: true  level: full  listen_addr: 127.0.0.1  listen_port: 6060

Environment variable#

It is possible to set a configuration value based on an enrivonement variables.

For example, if you don't want to store your database password in the configuration file, you can do this:

db_config:  type:     mysql  user:     database_user  password: ${DB_PASSWORD}  db_name:  db_name  host:     192.168.0.2  port:     3306

And export the environment variable such as:

export DB_PASSWORD="<db_password>"

warning

Note: you need to be root or put the environment variable in /etc/environment

Configuration directives#

/etc/crowdsec/config.yaml

common:  daemonize: "(true|false)"  pid_dir: "<path_to_pid_folder>"  log_media: "(file|stdout)"  log_level: "(error|info|debug|trace)"  log_dir: "<path_to_log_folder>"  working_dir: "<path_to_working_folder>"  log_max_size: <max_size_of_log_file>  log_max_age: <max_age_of_log_file>  log_max_files: <number_of_log_files_to_keep>  compress_logs: (true|false)config_paths:  config_dir: "<path_to_crowdsec_config_folder>"  data_dir: "<path_to_crowdsec_data_folder>"  simulation_path: "<path_to_simulation_file>"  hub_dir: "<path_to_crowdsec_hub_folder>"  index_path: "<path_to_hub_index_file>"  notification_dir: "<path_to_notification_config_folder>"  plugin_dir: "<path_to_notification_binaries_folder>"crowdsec_service:  acquisition_path: "<acqusition_file_path>"  acquisition_dir: "<acquisition_dir_path>"  parser_routines: "<number_of_parser_routines>"  buckets_routines: "<number_of_buckets_routines>"  output_routines: "<number_of_output_routines>"plugin_config:  user: "<user_to_run_plugin_process_as>"  group: "<group_to_run_plugin_process_as>"cscli:  output: "(human|json|raw)"  hub_branch: "<hub_branch>"db_config:  type:     "<db_type>"  db_path:  "<path_to_database_file>"  user:     "<db_user>"      # for mysql/pgsql  password: "<db_password>"  # for mysql/pgsql  db_name:  "<db_name>"      # for mysql/pgsql  host:     "<db_host_ip>"   # for mysql/pgsql  port:     "<db_host_port>" # for mysql/pgsql  sslmode:  "<required/disable>" # for pgsql  max_open_conns: "<max_number_of_conns_to_db>"  flush:    max_items: "<max_alerts_in_db>"    max_age: "<max_age_of_alerts_in_db>"api:  client:    insecure_skip_verify: "(true|false)"    credentials_path: "<path_to_local_api_client_credential_file>"  server:    log_level: "(error|info|debug|trace>")"    listen_uri: "<listen_uri>" # host:port    profiles_path: "<path_to_profile_file>"    use_forwarded_for_headers: "<true|false>"    console_path: <path_to_console_file>    online_client:      credentials_path: "<path_to_crowdsec_api_client_credential_file>"    tls:      cert_file: "<path_to_certificat_file>"      key_file: "<path_to_certificat_key_file>"    trusted_ips: # IPs or IP ranges which should have admin API access      #- 127.0.0.1      #- ::1      #- 10.0.0.0/24prometheus:  enabled: "(true|false)"  level: "(full|aggregated)"  listen_addr: "<listen_address>"  listen_port: "<listen_port>"

`common`#

common:  daemonize: "(true|false)"  pid_dir: "<path_to_pid_folder>"  log_media: "(file|stdout)"  log_level: "(error|info|debug|trace)"  log_dir: "<path_to_log_folder>"  working_dir: "<path_to_working_folder>"  log_max_size: <max_size_of_log_file>  log_max_age: <max_age_of_log_file>  log_max_files: <number_of_log_files_to_keep>  compress_logs: (true|false)

`daemonize`#

Daemonize or not the crowdsec daemon.

`pid_dir`#

Folder to store PID file.

`log_media`#

Log media. Can be stdout or file.

`log_level`#

Log level. Can be error, info, debug, trace.

`log_folder`#

Folder to write log file.

warning

Works only with log_media = file.

`working_dir`#

Current working directory.

`log_max_size`#

Maximum size the log file in MB before rotating it.

`log_max_age`#

Maximum age of previous log files before deleting them.

`log_max_files`#

Number of previous log files to keep.

`compress_logs`#

Whether to compress the log file after rotation or not.

`config_paths`#

This section contains most paths to various sub configuration items.

config_paths:  config_dir: "<path_to_crowdsec_config_folder>"  data_dir: "<path_to_crowdsec_data_folder>"  simulation_path: "<path_to_simulation_file>"  hub_dir: "<path_to_crowdsec_hub_folder>"  index_path: "<path_to_hub_index_file>"  notification_dir: "<path_to_notification_config_folder>"  plugin_dir: "<path_to_notification_binaries_folder>"

`config_dir`#

Main configuration directory of crowdsec.

`data_dir`#

This is where crowdsec is going to store data, such as files downloaded by scenarios, geolocalisation database, metabase configuration database, or even SQLite database.

`simulation_path`#

Path to the simulation configuration.

`hub_dir`#

Directory where cscli will store parsers, scenarios, collections and such.

`index_path`#

Path to the .index.json file downloaded by cscli to know the list of available configurations.

`plugin_dir`#

Note: binaries must be root-owned and non-world writable, and binaries/scripts must be named like <plugin_type>-<plugin_subtype> eg "notification-slack"

`notification_dir`#

Each notification plugin is expected to have its own configuration file.

`crowdsec_service`#

This section is only used by crowdsec agent.

crowdsec_service:  acquisition_path: "<acqusition_file_path>"  acquisition_dir: "<acqusition_dir_path>"  parser_routines: "<number_of_parser_routines>"  buckets_routines: "<number_of_buckets_routines>"  output_routines: "<number_of_output_routines>"

`parser_routines`#

Number of dedicated goroutines for parsing files.

`buckets_routines`#

Number of dedicated goroutines for managing live buckets.

`output_routines`#

Number of dedicated goroutines for pushing data to local api.

`acquisition_path`#

Path to the yaml file containing logs that needs to be read.

`acquisition_dir`#

(>1.0.7) Path to a directory where each yaml is considered as a acquisition configuration file containing logs that needs to be read. If both acquisition_dir and acquisition_path are specified, the entries are merged alltogether.

`cscli`#

This section is only used by cscli.

cscli:  output: "(human|json|raw)"  hub_branch: "<hub_branch>"  prometheus_uri: "<uri>"

`output`#

The default output format (human, json or raw).

`hub_branch`#

The git branch on which cscli is going to fetch configurations.

`prometheus_uri`#

(>1.0.7) An uri (without the trailing /metrics) that will be used by cscli metrics command, ie. http://127.0.0.1:6060/

`plugin_config`#

`user`#

The owner of the plugin process. If set to an empty string, the plugin process will run as the same user as crowdsec. Both user and group must be either set or unset.

`group`#

The group of the plugin process. If set to an empty string, the plugin process will run in the same group as crowdsec. Both user and group must be either set or unset.

`db_config`#

The configuration of the database to use for the local API.

db_config:  type:     "<db_type>"
  db_path:  "<path_to_database_file>"  # for sqlite
  user:     "<db_user>"      # for mysql/postgresql/pgx  password: "<db_password>"  # for mysql/postgresql/pgx  db_name:  "<db_name>"      # for mysql/postgresql/pgx  host:     "<db_host_ip>"   # for mysql/postgresql/pgx  port:     "<db_host_port>" # for mysql/postgresql/pgx  sslmode:  "<required/disable>" # for postgresql/pgx  max_open_conns: "<max_number_of_conns_to_db>"  flush:    max_items: "<max_alerts_in_db>"    max_age: "<max_age_of_alerts_in_db>"

`type`#

db_config:  type: sqlite

The type of database to use. It can be:

sqlite
mysql
postgresql
pgx

`db_path`#

db_config:  type: sqlite  db_path: "/var/lib/crowdsec/data/crowdsec.db

The path to the database file (only if the type of database is sqlite)

`user`#

db_config:  type: mysql|postgresql|pgx
  user: foo

The username to connect to the database (only if the type of database is mysql or postgresql)

`password`#

db_config:  type: mysql|postgresql|pgx
  password: foobar

The password to connect to the database (only if the type of database is mysql or postgresql)

`db_name`#

db_config:  type: mysql|postgresql|pgx
  db_name: crowdsec

The database name to connect to (only if the type of database is mysql or postgresql)

`db_host`#

db_config:  type: mysql|postgresql|pgx
  user: foo

The host to connect to (only if the type of database is mysql or postgresql)

`db_port`#

db_config:  type: mysql|postgresql|pgx
  user: foo

The port to connect to (only if the type of database is mysql or postgresql)

db_config:  type: postgresql
  sslmode: required

Required or disable ssl connection to database (only if the type of database is postgresql)

`max_open_conns`#

db_config:  type: mysql|postgresql|pgx|sqlite  max_open_conns: 100

Maximum number of open connections to the database.

Defaults to 100. Set to 0 for unlimited connections.

`flush`#

flush:  max_items: <nb_max_alerts_in_database>  max_age: <max_alerts_age_in_database>

`max_items`#

Number max of alerts in database.

`max_age`#

Alerts retention time.

Supported units:

s: seconds
m: minutes
h: hours
d: days

`api`#

The api section is used by both cscli, crowdsec and the local API.

api:  client:    insecure_skip_verify: "(true|false)"    credentials_path: "<path_to_local_api_client_credential_file>"  server:    log_level: "(error|info|debug|trace>"    listen_uri: "<listen_uri>" # host:port    profiles_path: "<path_to_profile_file>"    use_forwarded_for_headers: "(true|false)"    console_path: <path_to_console_file>    online_client:      credentials_path: "<path_to_crowdsec_api_client_credential_file>"    tls:      cert_file: "<path_to_certificat_file>"      key_file: "<path_to_certificat_key_file>"

`client`#

The client subsection is used by crowdsec and cscli to read and write decisions to the local API.

client:  insecure_skip_verify: "(true|false)"  credentials_path: "<path_to_local_api_client_credential_file>"

`insecure_skip_verify`#

Allows the use of https with self-signed certificates.

`credentials_path`#

Path to the credential files (contains API url + login/password).

`server`#

The server subsection is the local API configuration.

server:  log_level: (error|info|debug|trace)  listen_uri: <listen_uri> # host:port  profiles_path: <path_to_profile_file>  use_forwarded_for_headers: (true|false)  trusted_ips: # IPs or IP ranges which should have admin API access    #- 127.0.0.1    #- ::1    #- 10.0.0.0/24  console_path: <path_to_console_file>  online_client:    credentials_path: <path_to_crowdsec_api_client_credential_file>  tls:    cert_file: <path_to_certificat_file>    key_file: <path_to_certificat_key_file>

`listen_uri`#

Address and port listen configuration, the form host:port.

`profiles_path`#

The path to the profiles configuration.

`console_path`#

The path to the console configuration.

`use_forwarded_for_headers`#

Allow the usage of X-Forwarded-For or X-Real-IP to get the client IP address. Do not enable if you are not running the LAPI behind a trusted reverse-proxy or LB.

`online_client`#

Configuration to push signals and receive bad IPs from Crowdsec API.

online_client:  credentials_path: "<path_to_crowdsec_api_client_credential_file>"

`credentials_path`#

Path to a file containing credentials for the Central API.

`tls`#

if present, holds paths to certs and key files.

tls:  cert_file: "<path_to_certificat_file>"  key_file: "<path_to_certificat_key_file>"

`cert_file`#

Path to certificate file.

`key_file`#

Path to certficate key file.

`trusted_ips`#

IPs or IP ranges which have admin access to API. The APIs would still need to have API keys. 127.0.0.1 and ::1 are always given admin access whether specified or not.

`prometheus`#

This section is used by local API and crowdsec.

prometheus:  enabled: "(true|false)"  level: "(full|aggregated)"  listen_addr: "<listen_address>"  listen_port: "<listen_port>"

`enabled`#

Allows to enable/disable prometheus instrumentation.

`level`#

Can be full (all metrics) or aggregated (to allow minimal metrics that will keep cardinality low).

`listen_addr`#

Prometheus listen url.

`listen_port`#

Prometheus listen port.

Configuration example#

Environment variable#

warning

Configuration directives#

common#

daemonize#

pid_dir#

log_media#

log_level#

log_folder#

warning

working_dir#

log_max_size#

log_max_age#

log_max_files#

compress_logs#

config_paths#

config_dir#

data_dir#

simulation_path#

hub_dir#

index_path#

plugin_dir#

notification_dir#

crowdsec_service#

parser_routines#

buckets_routines#

output_routines#

acquisition_path#

acquisition_dir#

cscli#

output#

hub_branch#

prometheus_uri#

plugin_config#

user#

group#

db_config#

type#

db_path#

user#

password#

db_name#

db_host#

db_port#

max_open_conns#

flush#

max_items#

max_age#

api#

client#

insecure_skip_verify#

credentials_path#

server#

listen_uri#

profiles_path#

console_path#

use_forwarded_for_headers#

online_client#

credentials_path#

tls#

cert_file#

key_file#

trusted_ips#

prometheus#

enabled#

level#

listen_addr#

listen_port#

`common`#

`daemonize`#

`pid_dir`#

`log_media`#

`log_level`#

`log_folder`#

`working_dir`#

`log_max_size`#

`log_max_age`#

`log_max_files`#

`compress_logs`#

`config_paths`#

`config_dir`#

`data_dir`#

`simulation_path`#

`hub_dir`#

`index_path`#

`plugin_dir`#

`notification_dir`#

`crowdsec_service`#

`parser_routines`#

`buckets_routines`#

`output_routines`#

`acquisition_path`#

`acquisition_dir`#

`cscli`#

`output`#

`hub_branch`#

`prometheus_uri`#

`plugin_config`#

`user`#

`group`#

`db_config`#

`type`#

`db_path`#

`user`#

`password`#

`db_name`#

`db_host`#

`db_port`#

`max_open_conns`#

`flush`#

`max_items`#

`max_age`#

`api`#

`client`#

`insecure_skip_verify`#

`credentials_path`#

`server`#

`listen_uri`#

`profiles_path`#

`console_path`#

`use_forwarded_for_headers`#

`online_client`#

`credentials_path`#

`tls`#

`cert_file`#

`key_file`#

`trusted_ips`#

`prometheus`#

`enabled`#

`level`#

`listen_addr`#

`listen_port`#