Skip to content

Commit b072916

Browse files
rr404jdv
andauthored
fixing carriage return necessary for details not to breka in console view (#948)
Co-authored-by: jdv <julien@crowdsec.net>
1 parent 2a7404e commit b072916

File tree

6 files changed

+34
-2
lines changed

6 files changed

+34
-2
lines changed

crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_parsed.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ sudo cscli metrics show acquisition parsers
3333
```bash
3434
docker exec crowdsec cscli metrics show acquisition parsers
3535
```
36+
3637
```bash
3738
kubectl exec -n crowdsec -it <agent-pod> -- cscli metrics show acquisition parsers
3839
```

crowdsec-docs/unversioned/troubleshooting/issue_lp_no_logs_read.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,11 @@ sudo cscli metrics show acquisition
6262
```bash
6363
docker exec crowdsec cscli metrics show acquisition
6464
```
65+
6566
```bash
6667
kubectl exec -n crowdsec -it <agent-pod> -- cscli metrics show acquisition
6768
```
69+
6870
</details>
6971

7072
**What to look for:**

crowdsec-docs/unversioned/troubleshooting/issue_lp_offline.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,11 @@ Or [check the logs](/u/troubleshooting/security_engine#where-are-the-logs-stored
4040
```bash
4141
docker ps --filter name=crowdsec
4242
```
43+
4344
```bash
4445
kubectl get pods -n crowdsec
4546
```
47+
4648
</details>
4749

4850
On the LAPI node, run `sudo cscli machines list` and check whether the `Last Update` column is older than 24 hours for the affected machine.
@@ -61,9 +63,11 @@ sudo systemctl restart crowdsec
6163
```bash
6264
docker restart crowdsec
6365
```
66+
6467
```bash
6568
kubectl rollout restart deployment/crowdsec -n crowdsec
6669
```
70+
6771
</details>
6872

6973
After the restart, verify the agent is checking in:
@@ -100,9 +104,11 @@ sudo cscli machines list
100104
```bash
101105
docker exec crowdsec cscli machines list
102106
```
107+
103108
```bash
104109
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli machines list
105110
```
111+
106112
</details>
107113

108114
- If the machine shows in `PENDING` state or is missing entirely, credentials need validation

crowdsec-docs/unversioned/troubleshooting/issue_se_no_alerts.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,15 @@ sudo cscli collections list
3737
```
3838
<details>
3939
<summary>Run this command for Docker or Kubernetes</summary>
40+
4041
```bash
4142
docker exec crowdsec cscli collections list
4243
```
44+
4345
```bash
4446
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli collections list
4547
```
48+
4649
</details>
4750

4851
Compare your installed collections against your actual services (nginx, apache, ssh, etc.). Missing collections means no detection rules for those services.
@@ -76,6 +79,7 @@ sudo systemctl reload crowdsec
7679
```bash
7780
docker exec crowdsec cscli collections install crowdsecurity/nginx
7881
```
82+
7983
```bash
8084
docker restart crowdsec
8185
```
@@ -84,9 +88,11 @@ docker restart crowdsec
8488
```bash
8589
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli collections install crowdsecurity/nginx
8690
```
91+
8792
```bash
8893
kubectl rollout restart deployment/crowdsec -n crowdsec
8994
```
95+
9096
</details>
9197

9298
### Events massively whitelisted
@@ -107,10 +113,12 @@ sudo cscli metrics show acquisition
107113
```bash
108114
docker exec crowdsec cscli metrics show scenarios
109115
```
116+
110117
**Kubernetes**
111118
```bash
112119
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli metrics show scenarios
113120
```
121+
114122
</details>
115123

116124
**Look at the Lines whitelisted column**
@@ -157,6 +165,7 @@ docker exec crowdsec cscli simulation status
157165
```bash
158166
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli simulation status
159167
```
168+
160169
</details>
161170

162171
If scenarios are listed, they're in simulation mode and won't be sent to CrowdSec console (they should however still appear in `cscli alerts list`).
@@ -176,6 +185,7 @@ sudo systemctl reload crowdsec
176185
```bash
177186
docker exec crowdsec cscli simulation disable --all
178187
```
188+
179189
```bash
180190
docker restart crowdsec
181191
``
@@ -184,9 +194,11 @@ docker restart crowdsec
184194
```bash
185195
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli simulation disable --all
186196
```
197+
187198
```bash
188199
kubectl rollout restart deployment/crowdsec -n crowdsec
189200
```
201+
190202
</details>
191203

192204
You can also disable simulation for specific scenarios only:
@@ -219,10 +231,12 @@ sudo cscli metrics show acquisition parsers
219231
```bash
220232
docker exec crowdsec cscli metrics show acquisition parsers
221233
```
234+
222235
**Kubernetes**
223236
```bash
224237
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli metrics show acquisition parsers
225238
```
239+
226240
</details>
227241

228242
Look at "Lines parsed" - if this number is very low (dozens or hundreds per day), you may simply have insufficient traffic volume for malicious activity to appear.
@@ -245,6 +259,7 @@ sudo cscli metrics show bouncers
245259
```bash
246260
docker exec crowdsec cscli decisions list
247261
```
262+
248263
```bash
249264
docker exec crowdsec cscli metrics show bouncers
250265
```
@@ -253,9 +268,11 @@ docker exec crowdsec cscli metrics show bouncers
253268
```bash
254269
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli decisions list
255270
```
271+
256272
```bash
257273
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli metrics show bouncers
258274
```
275+
259276
</details>
260277

261278
High numbers of active decisions or bouncer blocks may indicate your proactive defenses are effectively blocking all malicious actors. However lets make sure no other issues

crowdsec-docs/unversioned/troubleshooting/issue_se_offline.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,12 @@ sudo journalctl -u crowdsec -n 50
3434

3535
<details>
3636
<summary>Run this command for Docker or Kubernetes</summary>
37+
3738
```bash
3839
docker ps --filter name=crowdsec
3940
kubectl get pods -n crowdsec
4041
```
42+
4143
</details>
4244

4345
If the host itself is unreachable (hypervisor, VM, or cloud instance down), the Console cannot receive a heartbeat and marks the engine offline.
@@ -52,6 +54,7 @@ sudo systemctl restart crowdsec
5254

5355
<details>
5456
<summary>For Docker or Kubernetes</summary>
57+
5558
**Docker:**
5659
```bash
5760
docker restart crowdsec
@@ -61,6 +64,7 @@ docker restart crowdsec
6164
```bash
6265
kubectl rollout restart deployment/crowdsec -n crowdsec
6366
```
67+
6468
</details>
6569

6670
After restarting, re-run `sudo cscli console status` to ensure the heartbeat is restored.

crowdsec-docs/unversioned/troubleshooting/issue_se_too_many_alerts.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,12 @@ Docker
4141
```bash
4242
docker exec crowdsec cscli alerts list -l 100
4343
```
44+
4445
Kubernetes
4546
```bash
4647
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli alerts list -l 100
4748
```
49+
4850
</details>
4951

5052
2. Look for patterns:
@@ -61,15 +63,15 @@ sudo cscli metrics show scenarios
6163

6264
<details>
6365
<summary>Run this command for Docker or Kubernetes</summary>
64-
Docker
66+
6567
```bash
6668
docker exec crowdsec cscli metrics show scenarios
6769
```
6870

69-
Kubernetes
7071
```bash
7172
kubectl exec -n crowdsec -it $(kubectl get pods -n crowdsec -l type=lapi -o name) -- cscli metrics show scenarios
7273
```
74+
7375
</details>
7476

7577
Look for scenarios with extremely high "Overflow" counts or "Current count" numbers.

0 commit comments

Comments
 (0)