Describe the problem
Crowdsec Console shows degraded health for my connected NB security engine due to the lack of alerts over 48hrs. I have followed both CS and NB docs to narrow down the cause. I have a healthy stack and am seeing blocklist decisions/metrics when I run docker compose exec crowdsec cscli decisions list --origin CAPI | head -20 and docker compose exec crowdsec sh -c "wget -qO- ``http://127.0.0.1:6060/metrics``" | grep '^cs_active_decisions' commands so, it appears the NB side of things is working.
When I run docker exec netbird-crowdsec cscli metrics show acquisition, I receive an empty table with +--------------------------------------------------------------------------------------------------+
| Acquisition Metrics |
+--------+------------+--------------+----------------+------------------------+-------------------+
| Source | Lines read | Lines parsed | Lines unparsed | Lines poured to bucket | Lines whitelisted |
+--------+------------+--------------+----------------+------------------------+-------------------+
+--------+------------+--------------+----------------+------------------------+-------------------+
Same goes for parsers and other metrics suggested by CS docs. I attempted to create an acquis.yaml file with Docker as a source and mounting the Docker sock to the netbird-crowdsec container but I still receive empty tables. I also made sure to add the crowdsec.enable=true labels to my stack.
Also attempted to mount /var/log to the CS container and added an acquis.yaml for journalctl following the guide in the CS docs. No joy there, either.
Crowdsec was installed in my stack from scratch with the NB install script on a Debian 13 VPS
Expected behavior
I should be seeing metrics flowing through from my LAPI to the CS console once I get log acquisition and parsing ironed out.
Are you using NetBird Cloud?
Self-hosted
NetBird version
netbird version0.79.0
Crowdsec version 1.8.0
Is any other VPN software installed?
No