CrowdSec - the open-source and participative security solution offering crowdsourced protection against malicious IPs and access to the most advanced real-world CTI.
CrowdSec agent process crashes if it can't tail a file:
crowdsec.service - Crowdsec agent
Loaded: loaded (/usr/lib/systemd/system/crowdsec.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Wed 2022-10-26 08:14:18 UTC; 17min ago
Process: 13016 ExecStart=/usr/bin/crowdsec -c /etc/crowdsec/config.yaml (code=exited, status=1/FAILURE)
Process: 13003 ExecStartPre=/usr/bin/crowdsec -c /etc/crowdsec/config.yaml -t (code=exited, status=0/SUCCESS)
Main PID: 13016 (code=exited, status=1/FAILURE)
Oct 26 08:09:06 myhost.com systemd[1]: Starting Crowdsec agent...
Oct 26 08:09:07 myhost.com crowdsec[13003]: time="2022-10-26T08:09:07Z" level=warning msg="Deprecation warning: the pid_dir config can be safely removed and is not required"
Oct 26 08:09:09 myhost.com crowdsec[13016]: time="2022-10-26T08:09:09Z" level=warning msg="Deprecation warning: the pid_dir config can be safely removed and is not required"
Oct 26 08:09:10 myhost.com systemd[1]: Started Crowdsec agent.
Oct 26 08:14:18 myhost.com crowdsec[13016]: time="26-10-2022 08:14:18" level=fatal msg="starting acquisition error : tail for /var/log/apache2/domlogs/ftpxferlog.offse...k is empty"
Oct 26 08:14:18 myhost.com systemd[1]: crowdsec.service: main process exited, code=exited, status=1/FAILURE
Oct 26 08:14:18 myhost.com systemd[1]: Unit crowdsec.service entered failed state.
Oct 26 08:14:18 myhost.com systemd[1]: crowdsec.service failed.
This happened if the file has been deleted after the agent detected it and before the tail happens
When acquis is on a folder/ it happens
Use case is for WHM filenames:
Apache acquis for files is `- /var/log/apache2/domlogs/` and some random files pop-inAndOut of this folder triggering the acquisition crash
What did you expect to happen?
Agent should handle the error and not crash
How can we reproduce it (as minimally and precisely as possible)?
have an acquis file like "folder/*"
run crowdsec
make a script creating and then immediately deleting them
Bug is fixed, tests are missing, but I have a pending refactoring (extract a static validation method from the Configure method) before doing this one.
What happened?
CrowdSec agent process crashes if it can't tail a file:
This happened if the file has been deleted after the agent detected it and before the tail happens
When acquis is on a folder/ it happens Use case is for WHM filenames: Apache acquis for files is `- /var/log/apache2/domlogs/` and some random files pop-inAndOut of this folder triggering the acquisition crash
What did you expect to happen?
Agent should handle the error and not crash
How can we reproduce it (as minimally and precisely as possible)?
have an acquis file like "folder/*" run crowdsec make a script creating and then immediately deleting them
Anything else we need to know?
No response
Crowdsec version
OS version
Enabled collections and parsers
Acquisition config
Config show