Skip to content

Fix: Add journald log acquisition example for Debian 12 compatibility#15

Open
oberator wants to merge 1 commit intopsycho0verload:mainfrom
oberator:patch-1
Open

Fix: Add journald log acquisition example for Debian 12 compatibility#15
oberator wants to merge 1 commit intopsycho0verload:mainfrom
oberator:patch-1

Conversation

@oberator
Copy link
Copy Markdown
Contributor

Fix: Update acquis.yaml to use journald instead of missing syslog files on Debian 12

📄 Description

On Debian 12 i'm facing the following error:

time="2025-04-28T10:28:07+02:00" level=info msg="Adding file /var/log/auth.log to datasources" type=file
time="2025-04-28T10:28:07+02:00" level=warning msg="No matching files for pattern /var/log/syslog" type=file
time="2025-04-28T10:28:07+02:00" level=warning msg="No matching files for pattern /var/log/traefik/access.log" type=file
time="2025-04-28T10:28:07+02:00" level=info msg="Starting processing data"
time="2025-04-28T10:28:07+02:00" level=warning msg="/var/log/auth.log is a directory, ignoring it." type=file

This pull request updates the documentation (README.md) to address this issue and properly support Debian 12 and newer distributions that use systemd's journald for log management instead of traditional file-based logs like /var/log/syslog and /var/log/auth.log.

Changes made:

🔍 Reason for Change

On Debian 12 and similar systemd-based systems:

  • /var/log/syslog and /var/log/auth.log do not exist by default.

  • CrowdSec emits warnings about missing files and cannot monitor authentication or system events properly.

  • journalctl is the current best-practice for log acquisition.

This update ensures that users of the traefik-crowdsec-stack have clear guidance for configuring log acquisition reliably on modern operating systems.

Fix: Update acquis.yaml to use journald instead of missing syslog files on Debian 12
Copy link
Copy Markdown
Owner

@psycho0verload psycho0verload left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, it's not that simple. I checked this in the latest instructions, but it's not possible without granting further rights. Since CrowdSec runs in a container and not natively on the server

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants