Crowdsec widget showing incorrect # of alerts

[mgrimace]

Description

Hi,
My Crowdsec widget is showing 5 alerts; however, my sudo docker exec -it crowdsec cscli alerts list shows No active alerts and zero at app.crowdsec.net.

Crowdsec is on the same docker network, and I did change the port from 8080->8888 in the compose.yaml, config.yaml, and local_api_credentials.yaml

homepage version

nightly (986a181, May 9, 2024)

Installation method

Docker

Configuration

- Crowdsec:
        icon: crowdsec
        href: https://app.crowdsec.net/security-engines
        server: my-docker
        container: crowdsec
        widget:
          type: crowdsec
          url: http://crowdsec:8888
          username: localhost # machine_id in crowdsec
          password: {{HOMEPAGE_VAR_CROWDSEC_PASSWORD}}

Container Logs

docker logs homepage
Listening on port 3000
[2024-05-11T16:55:53.396Z] warn: API response for /api/services/proxy?type=crowdsec&group=Network&service=Crowdsec&endpoint=alerts exceeds 4MB. API Routes are meant to respond quickly. https://nextjs.org/docs/messages/api-routes-response-size-limit
[2024-05-11T16:58:42.570Z] warn: API response for /api/services/proxy?type=crowdsec&group=Network&service=Crowdsec&endpoint=alerts exceeds 4MB. API Routes are meant to respond quickly. https://nextjs.org/docs/messages/api-routes-response-size-limit
[2024-05-11T17:00:27.434Z] warn: API response for /api/services/proxy?type=crowdsec&group=Network&service=Crowdsec&endpoint=alerts exceeds 4MB. API Routes are meant to respond quickly. https://nextjs.org/docs/messages/api-routes-response-size-limit

Browser Logs

No response

Troubleshooting

Not relevant

[glime-ai[bot]]

Thanks for posting a discussion about homepage here on GitHub. Homepage now uses a fancy new AI tool thanks to our friends at Glime, so the answer below is the AI bot's attempt to answer your question. If you feel it's sufficient you can mark the answer and close this post, otherwise feel free to leave it open of course!

Thanks for using Homepage! ❤️

---

Based on the information provided, it seems that the Crowdsec widget is fetching a large amount of data, which is causing high memory and CPU usage as indicated by the warning logs from the Homepage container. The discrepancy between the widget showing 5 alerts and the cscli command showing no active alerts could be due to caching or a misconfiguration.

Here are a few steps you can take to troubleshoot the issue:

1. Verify Configuration: Ensure that the url in your configuration matches the port you've set for Crowdsec after changing it from 8080 to 8888. Also, confirm that the username and password fields are correctly set with the credentials from local_api_credentials.yaml.

2. Check Network Connectivity: Since both services are on the same Docker network, verify that the Homepage container can communicate with the Crowdsec container using the updated port 8888. You can do this by executing a command like docker exec homepage curl http://crowdsec:8888.

3. API Response Size: The warning logs indicate that the API response size exceeds 4MB, which is not ideal for quick API routes. You may want to check if there's a way to limit the number of alerts fetched by the widget. This could involve looking into the Crowdsec API documentation for any available filters or pagination options.

4. Review Crowdsec API: It's possible that the Crowdsec API is returning more data than expected. You can use curl to manually check the API response from the Homepage container to see what data is being returned at the /alerts endpoint.

5. Check for Updates: Since you are using the nightly build of Homepage, ensure that there are no updates or bug fixes related to the Crowdsec widget that you might be missing.

6. Contact Support: If the issue persists, consider reaching out to the Homepage support channels, such as the GitHub discussions or Discord, for further assistance. Provide them with the details of your configuration and the logs you've collected.

Remember to replace any sensitive information such as passwords with placeholders when sharing your configuration for troubleshooting.

This comment was generated by Glime.

[mgrimace]

Strangely, the alerts have gone up +2 to 7 with 0 alerts in actual Crowdsec

[shamoon]

I have noticed differences in the cli tool but their API is just a little underwhelming in my opinion. The widget grabs /alerts/ /v1/alerts?decision_type=ban&origin=crowdsec&has_active_decision=1

[mgrimace]

Ah ok, I see, it seems to get the bans but also the ‘decisions’ that are updates to the blocklists, which seem to happen when I restart my container, e.g. 48 │ lists:firehol_greensnow (6821 Ips) │ update : +6821/-0 IPs │ │ │ ban:6821 │ 2024-05-13 01:30:06 +0000 UTC │ it’s not technically a ‘ban’ ban like a new single-ip threat, but it is technically banning IPs so it’s triggering the alert. Viewable via sudo docker exec -it crowdsec cscli alerts list -a as they don’t show up in list. Thanks for clarifying!

[github-actions[bot]]

This discussion has been automatically closed because it was marked as answered. See our contributing guidelines for more details.

[github-actions[bot]]

This discussion has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns. See our contributing guidelines for more details.