@@ -164,9 +164,8 @@ Acquisition configuration indicates to CrowdSec what log files it should look at
164164The Detection collections include parsers config and bad behavior detection scenarios for given services.
165165
166166In our case we' ll look at the nginx logs and apache2 logs.
167- - Identify the name of your application folder: ls /home/master/applications
168- - There should be a folder in there, lets say " abcdefghij"
169- - We' ll replace the content of the config/acquis.yaml file (with you editor of choice) with the following:
167+ - We' ll use wildcards to work with any application name of your application folder: ls /home/master/applications
168+ - Replace the content of the config/acquis.yaml file (with you editor of choice) with the following:
170169```yaml
171170filenames:
172171 - /home/master/applications/**/logs/nginx_*.log
@@ -178,7 +177,6 @@ filenames:
178177labels:
179178 type: apache2
180179```
181- - Don' t forget to put the appropriate path to your logs and not " abcdefghij"
182180
183181### Getting collections
184182Now we' ll install the collections for nginx and apache2.
@@ -219,9 +217,8 @@ We can run the behavior detection on the past logs to catch alerts that happened
219217We' ll run it on the nginx access logs and the first archive of nginx access logs (previous day)
220218- Run the behavior detection on the past logs:
221219` ` ` bash
222- ./crowdsec -c config.yaml -dsn file:///home/master/applications/abcdefghij /logs/nginx_*.access.log --type nginx --no-api
220+ ./crowdsec -c config.yaml -dsn file:///home/master/applications/\*\* /logs/nginx_* .access.log --type nginx --no-api
223221` ` `
224- - Again, dont forget to put your own application folder and not "abcdefghij"
225222- Note that ** dsn** parameter take the ** file://*** / protocol and an ** absolute path**
226223- After you ran the detection, detected alerts should be listed in:
227224` ` ` bash
0 commit comments