Skip to content

Commit 59ea577

Browse files
author
jdv
committed
addition of log rotation fix script and cron
1 parent 610dd51 commit 59ea577

File tree

1 file changed

+43
-0
lines changed
  • crowdsec-docs/unversioned/getting_started/installation

1 file changed

+43
-0
lines changed

crowdsec-docs/unversioned/getting_started/installation/cloudways.mdx

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,49 @@ exit 0
211211
```
212212
0 6 * * * /home/master/crowdsec/hub_update.sh
213213
```
214+
### Make sure log rotation not breaking acquisition
215+
As CrowdSec is not running as root in our current context, there could be some race conditions with log rotation file creation making the acquisition fail.
216+
Future versions of CrowdSec might address this issue, but for now, we can use a simple script to ensure the acquisition is not broken.
217+
218+
- Create a script to ensure the acquisition is not broken
219+
220+
```bash
221+
vi /home/master/crowdsec/check_rotation.sh
222+
```
223+
224+
```bash
225+
#!/bin/bash
226+
227+
# Set the path to your CrowdSec log file
228+
LOG_FILE="/home/master/crowdsec/logs/crowdsec.log"
229+
230+
# Get today's date in the format used in the logs (UTC time)
231+
TODAY=$(date -u +"%Y-%m-%d")
232+
233+
# Define the error pattern to search for
234+
ERROR_PATTERN='level=warning .* died : Unable to open file .*: permission denied'
235+
236+
# Search for the error in today's logs
237+
if grep "$TODAY" "$LOG_FILE" | grep -qE "$ERROR_PATTERN"; then
238+
# Log the action
239+
echo "$(date): Error found, restarting CrowdSec service" >> /home/master/crowdsec/logs/crowdsec_rotation_fail.log
240+
241+
# Restart the CrowdSec service
242+
systemctl restart --user crowdsec
243+
244+
# Log the completion
245+
echo "$(date): CrowdSec service restarted successfully" >> /home/master/crowdsec/logs/crowdsec_rotation_fail.log
246+
else
247+
# Log that no action was taken
248+
echo "$(date): No error found, no action taken" >> /home/master/crowdsec/logs/crowdsec_rotation_fail.log
249+
fi
250+
```
251+
252+
Make the check run every day at 00:01
253+
```bash
254+
1 0 * * * /home/master/crowdsec/check_rotation.sh
255+
```
256+
214257

215258
## Run a behavior detection on your past logs to see what it would have found
216259
We can run the behavior detection on the past logs to catch alerts that happened in the past.

0 commit comments

Comments
 (0)