Crowdsec fails to parse Traefik Logs - WORKAROUND PROVIDED #382

New Issue

MrUnknownDE · 2026-04-05T17:08:27+02:00

MrUnknownDE commented

2026-04-05 17:08:27 +02:00

Originally created by @rayjaymor85 on 1/14/2026

Describe the Bug

On a fresh install there are two lines missing in the default config/traefik/traefik_config.yml file that will prevent the crowdsec integration from parsing traefik logs properly.

I admit I'm not familiar enough with the codebase to find the template in guithub, but I was able to fix my crowdsec implementation (setup by the self-installer tool) by adding these two lines to accessLog.fields.names on the above mentioned file:

RouterName: keep
time: keep

So essentially the top of my traefik_config.yml file now looks like this:

accessLog:
 fields:
    defaultMode: drop
    names:
      RouterName: keep
      time: keep
      ClientAddr: keep
      ClientHost: keep
      DownstreamContentSize: keep
      DownstreamStatus: keep

after the above changes, crowdsec is now parsing my traefik logs just fine

Environment

OS Type & Version: Ubuntu 24.04
Pangolin Version: 1.41.1
Traefik Version: 3.6
Crowdsec 1.7.4

To Reproduce

Simply perform a fresh guided installer using the automated installer including the steps to install crowdsec.
Out of the box, traefik logs don't seem to be parsing when checking against `docker exec crowdsec cscli metrics'

Performing the above mentioned changes to config/traefik/traefik_config.yml then restarting the docker stack resolves the issue.

Expected Behavior

docker exec crowdsec cscli metrics should show traefik logs being parsed, with only a small percentage remaining unparsed.

*Originally created by @rayjaymor85 on 1/14/2026* ### Describe the Bug On a fresh install there are two lines missing in the default `config/traefik/traefik_config.yml` file that will prevent the crowdsec integration from parsing traefik logs properly. I admit I'm not familiar enough with the codebase to find the template in guithub, but I was able to fix my crowdsec implementation (setup by the self-installer tool) by adding these two lines to `accessLog.fields.names` on the above mentioned file: ``` RouterName: keep time: keep ``` So essentially the top of my `traefik_config.yml` file now looks like this: ``` accessLog: fields: defaultMode: drop names: RouterName: keep time: keep ClientAddr: keep ClientHost: keep DownstreamContentSize: keep DownstreamStatus: keep ``` after the above changes, crowdsec is now parsing my traefik logs just fine ### Environment - OS Type & Version: Ubuntu 24.04 - Pangolin Version: 1.41.1 - Traefik Version: 3.6 - Crowdsec 1.7.4 ### To Reproduce Simply perform a fresh guided installer using the automated installer including the steps to install crowdsec. Out of the box, traefik logs don't seem to be parsing when checking against `docker exec crowdsec cscli metrics' Performing the above mentioned changes to `config/traefik/traefik_config.yml` then restarting the docker stack resolves the issue. ### Expected Behavior `docker exec crowdsec cscli metrics` should show traefik logs being parsed, with only a small percentage remaining unparsed.

MrUnknownDE closed this issue

2026-04-05 17:08:27 +02:00

MrUnknownDE added the stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale labels 2026-04-05 17:08:28 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale stale

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#382