Skip to content

(fix): Added a logrotate function to the crowdsec.go installer file#2873

Merged
oschwartz10612 merged 2 commits into
fosrl:devfrom
sidd190:fix/crowdsec-traefik-logrotate
Apr 23, 2026
Merged

(fix): Added a logrotate function to the crowdsec.go installer file#2873
oschwartz10612 merged 2 commits into
fosrl:devfrom
sidd190:fix/crowdsec-traefik-logrotate

Conversation

@sidd190

@sidd190 sidd190 commented Apr 19, 2026 •
edited by oschwartz10612
Loading

Copy link
Copy Markdown
Contributor

Add logrotate config for Traefik access logs when CrowdSec is installed

Fixes #2644

Documentation Update : fosrl/docs-v2#98

What and why

The default Pangolin install does not enable Traefik access logging.
When CrowdSec is selected during installation, the installer enables Traefik access logs (required for CrowdSec to detect threats).

These logs are written to:
config/traefik/logs/access.log (on the host)

Without log rotation, this file grows indefinitely, which is the issue reported in #2644.

This change fixes the problem only in the CrowdSec installation path, keeping the default install unaffected.

What changed

File modified: install/crowdsec.go

  • Added a new function: setupTraefikLogRotate()
  • This function is called from installCrowdsec() immediately after the directory config/traefik/logs/ is created.
  • The function writes a logrotate configuration file to /etc/logrotate.d/pangolin-traefik using the absolute path to the access log (resolved from the install directory).

Logrotate configuration written:

/opt/pangolin/config/traefik/logs/access.log {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}

Note: copytruncate is the key directive. It copies the log file and then truncates the original in place.
This allows Traefik to continue writing to the same open file descriptor without needing a restart or SIGHUP signal.

If the installer is not running as root, it skips writing the file and instead prints the full configuration to stdout (with the actual resolved path), allowing the user to set it up manually.

Testing

The generated config was validated directly with logrotate:

# Check that the config parses cleanly
logrotate --debug /etc/logrotate.d/pangolin-traefik

# Force rotation (first time)
logrotate --force --state /tmp/test.state /etc/logrotate.d/pangolin-traefik

# Force rotation again (second time)
logrotate --force --state /tmp/test.state /etc/logrotate.d/pangolin-traefik

Observed behavior:

  • access.log is truncated in place after each rotation (Traefik’s file handle remains valid)
  • Most recent rotated file stays uncompressed for easy inspection (delaycompress)
  • Older files are compressed to .gz
  • After 7 rotations, the oldest file is automatically deleted

No changes were made to the default (non-CrowdSec) installation path as suggested by @oschwartz10612.

PS : Can someone please go through this comment and verify if a follow up PR like this is required where we are dropping the unused fields from crowdsec installation?

@sidd190 sidd190 mentioned this pull request Apr 19, 2026
Merged
@AstralDestiny

AstralDestiny commented Apr 19, 2026

Copy link
Copy Markdown
Contributor 
accessLog:
  filePath: "/logs/traefik/access.log"
  fields:
    headers:
      names:
        User-Agent: keep

For me, honestly don't even need User-Agent as I mostly have whitelists contained against traefik's own routers.

But my logs go back 2+ years and only sit with 185MB. What is the default access log look like for auto installs?

@sidd190

sidd190 commented Apr 19, 2026

Copy link
Copy Markdown
Contributor Author

For me, honestly don't even need User-Agent as I mostly have whitelists contained against traefik's own routers.

But my logs go back 2+ years and only sit with 185MB. What is the default access log look like for auto installs?

Ahh, to be honest, I'm still learning what everything is. First time contributor here. So I can't exactly be sure if these additional fields are actually being used much, which is why I flagged it for review to kind of give a signal on what can we drop and what not on a default install settings with crowdsec, and maybe that can be addressed with a seperate PR from this.

I'll try and take a look at the default access log though. Hope you understand, sorry.

@AstralDestiny

AstralDestiny commented Apr 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

No worries. 🙂

Also responding from discord right now. One of the support but haven't checked what the default install recently ships with.

@sidd190

sidd190 commented Apr 19, 2026

Copy link
Copy Markdown
Contributor Author

No worries. 🙂

Also responding from discord right now. One of the support but haven't checked what the default install recently ships with.

Ohh coool. I was thinking of putting an introduction on Discord right after getting this merged.

Umm soo, Should we wait for a response from someone else then? :)
(I think this PR might be kinda complete in itself for adding logrotate and stop the major problem though, and then the fields for optimizations and root cause of it. Maybe you can share your installation settings template if that's okay and we can compare with default a bit too)

@AstralDestiny

AstralDestiny commented Apr 19, 2026

Copy link
Copy Markdown
Contributor

I can't touch the pr stuff so will have to wait for the others. :), Made a bot that lets me respond from discord and see everything from a glance.

@sidd190

sidd190 commented Apr 19, 2026

Copy link
Copy Markdown
Contributor Author

I can't touch the pr stuff so will have to wait for the others. :), Made a bot that lets me respond from discord and see everything from a glance.

Got itt, thanks! (The bot sounds cool! :) )

@AstralDestiny

AstralDestiny commented Apr 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Not sure if I fixed this to upload though.

image

Nope got to fix uploading then

LaurenceJJones
LaurenceJJones reviewed Apr 20, 2026
View reviewed changes
Comment thread install/crowdsec.go Outdated
@sidd190

sidd190 commented Apr 23, 2026

Copy link
Copy Markdown
Contributor Author

@oschwartz10612 Can you please take a look at this whenever available?

oschwartz10612
oschwartz10612 approved these changes Apr 23, 2026
View reviewed changes

@oschwartz10612 oschwartz10612 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@oschwartz10612

oschwartz10612 commented Apr 23, 2026

Copy link
Copy Markdown
Member

Thanks!

@oschwartz10612 oschwartz10612 merged commit 925a59c into fosrl:dev Apr 23, 2026
3 checks passed
@sidd190

sidd190 commented Apr 23, 2026

Copy link
Copy Markdown
Contributor Author

Thanks!

Awesome! Thanks for the merge! There was a follow-up documentation PR for this too.

DOCS PR -> fosrl/docs-v2#98

@sidd190 sidd190 deleted the fix/crowdsec-traefik-logrotate branch April 23, 2026 19:32
@oschwartz10612

oschwartz10612 commented Apr 24, 2026 via email

Copy link
Copy Markdown
Member

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@oschwartz10612 oschwartz10612 oschwartz10612 approved these changes

@miloschwartz miloschwartz Awaiting requested review from miloschwartz miloschwartz is a code owner

+1 more reviewer

@LaurenceJJones LaurenceJJones LaurenceJJones left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@sidd190 @AstralDestiny @oschwartz10612 @LaurenceJJones