Troubleshoot

This section helps you resolve common installation issues. If you need more depth, see the full troubleshooting documentation.

Logs and errors

Before troubleshooting, find the underlying error. Logs are the best place to start.

Log locations vary by platform. Default locations:

• Linux /var/log/crowdsec.log
• Freebsd /var/log/crowdsec.log
  • Opnsense /var/log/crowdsec/crowdsec.log
  • Pfsense /var/log/crowdsec/crowdsec.log
• Windows C:\ProgramData\CrowdSec\log\crowdsec.log
• Kubernetes kubectl logs -n crowdsec crowdsec-(agent|lapi)-*

Filter logs for error messages

CrowdSec logs can be verbose. Use the commands below to filter for errors:

Linux/Freebsd

SH

sudo grep -E "level=(error|fatal)" /var/log/crowdsec.log

Windows

Powershell

SH

Select-String "level=(error|fatal)" C:\ProgramData\CrowdSec\log\crowdsec.log

CMD

SH

findstr "level=error level=fatal" C:\ProgramData\CrowdSec\log\crowdsec.log

Kubernetes

SH

kubectl logs -n crowdsec crowdsec-agent-* | grep -E "level=(error|fatal)"

info

Update the commands above if your log location differs.

Common errors and solutions

Port conflict

Error Message

SHError Message

level=fatal msg="while serving local API: listen tcp 127.0.0.1:8080: bind: address already in use"

By default (see prerequisites), CrowdSec uses ports 6060 and 8080. If another service uses these ports, update the CrowdSec configuration to use different ports.

Update these configuration files:

• Linux
  • /etc/crowdsec/config.yaml
  • /etc/crowdsec/local_api_credentials.yaml
• Freebsd, Opnsense, Pfsense
  • /usr/local/etc/crowdsec/config.yaml
  • /usr/local/etc/crowdsec/local_api_credentials.yaml
• Windows
  • C:\ProgramData\CrowdSec\config\config.yaml
  • C:\ProgramData\CrowdSec\config\local_api_credentials.yaml

Use your preferred editor to modify the files. Example:

info

These configuration files are owned by the default admin user and you will need to use sudo or Administrator permissions to modify them.

config.yaml

YAMLconfig.yaml

api:
 server:
   listen_uri: 127.0.0.1:8080 # CHANGE this line to the port you wish to listen on

local_api_credentials.yaml

YAMLlocal_api_credentials.yaml

url: http://127.0.0.1:8080 # CHANGE this line to the same port as you configured above
login: ...
password: ...

After making changes, restart the CrowdSec service.

Linux/Freebsd

SH

sudo systemctl restart crowdsec

Windows

SH

Restart-Service crowdsec

Kubernetes

SH

kubectl delete pod -n crowdsec crowdsec-agent-*

Next steps

If the above does not resolve your issue, see the full troubleshooting documentation.

If you resolved the issue, continue with the post-installation steps.