Closed C8opmBM closed 8 months ago
github-actions[bot]
commented
8 months ago @C8opmBM: Thanks for opening an issue, it is currently awaiting triage.
In the meantime, you can:
C8opmBM
commented
8 months ago I think it's related to https://github.com/crowdsecurity/hub/pull/961 But I don't know how to fix it.
LaurenceJJones
commented
8 months ago I think it's related to crowdsecurity/hub#961 But I don't know how to fix it.
The reason is seems authelia is in Debug mode and is logging lines that are not captured by the first node so it falls into the Unmarshal json which then generally errors because its a not a JSON line
C8opmBM
commented
8 months ago Unfortunately changing the log level to info (in authelia) does not fix it.
So I thought this was only related to LePresidente/Authelia but I noticed also Unmarshall errors with other unrelated errors/warns. Same when parsing the caddy logs, etc.
LE: I should add that I tested the filter (authelia) and it works as intended - blocked my repeated logins - so functionality doesn't seem to be affected. aFAIK I just would like to know what has recently changed, so I can fix these.
My caddy log format is as follows:
log {
output file {$LOG_FILE} {
roll_size 24b
roll_keep 10
roll_keep_for 720h
}
format json {
time_format wall
time_local
}
level INFO
}Do I need to change anything? It has been working fine (as mentioned) for a couple of years until recently.
LaurenceJJones
commented
8 months ago Unfortunately changing the log level to info (in authelia) does not fix it.
So I thought this was only related to LePresidente/Authelia but I noticed also Unmarshall errors with other unrelated errors/warns. Same when parsing the caddy logs, etc.
LE: I should add that I tested the filter (authelia) and it works as intended - blocked my repeated logins - so functionality doesn't seem to be affected. aFAIK I just would like to know what has recently changed, so I can fix these.
My caddy log format is as follows:
log { output file {$LOG_FILE} { roll_size 24b roll_keep 10 roll_keep_for 720h } format json { time_format wall time_local } level INFO }Do I need to change anything? It has been working fine (as mentioned) for a couple of years until recently.
No you dont need to change anything It still working fine, it just some log lines dont match the parsers so it errors when it tries to parse them as JSON. We could update the parser to check if the first character is a { to suppress the message
C8opmBM
commented
8 months ago Amazing, thank you!!
KonVei82
commented
7 months ago @LaurenceJJones i think i am having a similar issue with multiple errors in logs.
time="2024-03-19T14:39:24+02:00" level=warning msg="failed to run filter : unexpected end of JSON input (1:42)\n | evt.Parsed.program startsWith 'caddy' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'caddy') in ['', nil]\n | .........................................^" id=still-glitter name=crowdsecurity/caddy-logs stage=s01-parse
time="2024-03-19T14:39:24+02:00" level=error msg="UnmarshalJSON : invalid character ',' looking for beginning of value" line=","server_name":"auth.redacted.pro"}},"bytes_read":0,"user_id":"","duration":0.002094356,"size":0,"status":304,"resp_headers":{"Etag":["8e54fc845814eacc4dfc1639edd222a61621f1f7"],"Cache-Control":["public, max-age=0, must-revalidate"],"Server":["Caddy"],"Date":["Tue, 19 Mar 2024 12:39:24 GMT"]}}"
time="2024-03-19T14:39:24+02:00" level=warning msg="failed to run filter : invalid character ',' looking for beginning of value (1:42)\n | evt.Parsed.program startsWith 'caddy' && UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'caddy') in ['', nil]\n | .........................................^" id=still-glitter name=crowdsecurity/caddy-logs stage=s01-parseLet me know if i should open a new bug report.
What happened?
Hello,
I've been using crowdsec for maybe 2 years, it was a a set and forget thing, but lately I've seen constant errors in the logs.
Every 2-3 lines, I get one of these:
UnmarshalJSON : invalid character 'i' in literal true (expecting 'r')
I haven't made any changes to the config.
What did you expect to happen?
No errors
How can we reproduce it (as minimally and precisely as possible)?
Run crowdsec with authelia and some collections
Anything else we need to know?
My docker
Crowdsec version
OS version
Enabled collections and parsers
Acquisition config
No response
Config show
Prometheus metrics
No response
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.