no alerts at engine side, even id bounder drop traffic

[diroots]

Hi, i've set the haproxy-spoa-bouncer on some front servers, connected to the crowdsec engine

i did only set the ban action, for all blocklists

i can see dropped requests from my bouncer's metrics

# docker compose exec crowdsec cscli metrics show bouncers
╭────────────────────────────────────────────────────────────────────────╮
│ Bouncer Metrics (haproxy-spoa-front01) since 2025-12-11 13:43:16 +0000 │
│ UTC                                                                    │
├───────────────────────────────┬──────────────────┬─────────┬───────────┤
│ Origin                        │ active_decisions │ dropped │ processed │
│                               │        IPs       │ request │  request  │
├───────────────────────────────┼──────────────────┼─────────┼───────────┤
│ CAPI (community blocklist)    │           33.97k │     210 │         - │
│ cscli (manual decisions)      │                0 │       0 │         - │
│ lists:crowdsec_botnet         │           24.13k │     519 │         - │
│ lists:crowdsec_cve_2025_55182 │            8.85k │       - │         - │
│ lists:crowdsec_mail           │            7.96k │       - │         - │
│ lists:crowdsec_proxy          │           15.26k │     222 │         - │
│ lists:crowdsec_wordpress      │           21.72k │      94 │         - │
│ lists:firehol_botscout_7d     │            1.39k │     179 │         - │
│ lists:firehol_cybercrime      │              169 │       - │         - │
│ lists:firehol_greensnow       │              745 │      11 │         - │
│ lists:firehol_sslproxies_7d   │              421 │       2 │         - │
│ lists:free_proxies            │           27.70k │      65 │         - │
├───────────────────────────────┼──────────────────┼─────────┼───────────┤
│                         Total │          142.31k │   1.30k │    22.57k │
╰───────────────────────────────┴──────────────────┴─────────┴───────────╯
╭────────────────────────────────────────────────────────────────────────╮
│ Bouncer Metrics (haproxy-spoa-front02) since 2025-12-11 13:43:15 +0000 │
│ UTC                                                                    │
├───────────────────────────────┬──────────────────┬─────────┬───────────┤
│ Origin                        │ active_decisions │ dropped │ processed │
│                               │        IPs       │ request │  request  │
├───────────────────────────────┼──────────────────┼─────────┼───────────┤
│ CAPI (community blocklist)    │           33.96k │     240 │         - │
│ cscli (manual decisions)      │                0 │       - │         - │
│ lists:crowdsec_botnet         │           24.13k │     461 │         - │
│ lists:crowdsec_cve_2025_55182 │            8.85k │       - │         - │
│ lists:crowdsec_mail           │            7.96k │       - │         - │
│ lists:crowdsec_proxy          │           15.26k │     215 │         - │
│ lists:crowdsec_wordpress      │           21.72k │      95 │         - │
│ lists:firehol_botscout_7d     │            1.39k │     281 │         - │
│ lists:firehol_cybercrime      │              169 │       - │         - │
│ lists:firehol_greensnow       │              745 │       - │         - │
│ lists:firehol_sslproxies_7d   │              421 │       1 │         - │
│ lists:free_proxies            │           27.70k │      53 │         - │
├───────────────────────────────┼──────────────────┼─────────┼───────────┤
│                         Total │          142.31k │   1.35k │    21.37k │
╰───────────────────────────────┴──────────────────┴─────────┴───────────╯

but i still get a msg in the crowdsec dashboard stating no alerts since 2025-12-11

i can confirm that, at crowdse engine level, it reports no alerts

# docker compose exec crowdsec cscli alert list
No active alerts

but i can confirm that blocking do work from haproxy logs. any idea why, is it expected ?

[github-actions]

@diroots: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Documentation to see if your issue can be self resolved.
2. You can also join our Discord

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[github-actions]

@diroots: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.

• /kind feature
• /kind enhancement
• /kind bug
• /kind packaging

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[diroots]

/kind bug

[LaurenceJJones]

Hey the no alerts is not about blocks, its about local alerts triggered by reading logs.

So is CrowdSec actively reading haproxy logs? if you run cscli metrics show acquisition

example

root@debian-s-1vcpu-1gb-35gb-intel-lon1-01:~# cscli metrics show acquisition
╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Acquisition Metrics                                                                                                                           │
├─────────────────────────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────┤
│ Source                                              │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │
├─────────────────────────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤
│ appsec:appsec                                       │ 2          │ 2            │ -              │ 2                      │ -                 │
│ journalctl:journalctl-_SYSTEMD_UNIT=haproxy.service │ 1.78k      │ 379          │ 1.40k          │ 514                    │ -                 │
│ journalctl:journalctl-_SYSTEMD_UNIT=ssh.service     │ 10         │ -            │ 10             │ -                      │ -                 │
╰─────────────────────────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯

edit: you may also find cscli metrics show scenarios also helps.

Details

╭──────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Scenario Metrics                                                                                         │
├────────────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────┤
│ Scenario                                   │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├────────────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ LePresidente/http-generic-403-bf           │ -             │ 5         │ 24           │ 54     │ 19      │
│ crowdsecurity/CVE-2017-9841                │ -             │ 37        │ 37           │ -      │ -       │
│ crowdsecurity/appsec-vpatch                │ -             │ 1         │ 1            │ 2      │ -       │
│ crowdsecurity/http-admin-interface-probing │ -             │ 1         │ 7            │ 9      │ 6       │
│ crowdsecurity/http-backdoors-attempts      │ -             │ 2         │ 5            │ 7      │ 3       │
│ crowdsecurity/http-crawl-non_statics       │ -             │ -         │ 90           │ 117    │ 90      │
│ crowdsecurity/http-cve-2021-41773          │ -             │ 1         │ 1            │ -      │ -       │
│ crowdsecurity/http-cve-2021-42013          │ -             │ 1         │ 1            │ -      │ -       │
│ crowdsecurity/http-cve-probing             │ -             │ 3         │ 3            │ -      │ -       │
│ crowdsecurity/http-path-traversal-probing  │ -             │ -         │ 1            │ 2      │ 1       │
│ crowdsecurity/http-probing                 │ -             │ 8         │ 187          │ 302    │ 179     │
│ crowdsecurity/http-sensitive-files         │ -             │ 2         │ 15           │ 26     │ 13      │
│ crowdsecurity/netgear_rce                  │ -             │ 1         │ 1            │ -      │ -       │
╰────────────────────────────────────────────┴───────────────┴───────────┴──────────────┴────────┴─────────╯