Crowdsec widget showing incorrect Number of alerts #3472
Replies: 5 comments 4 replies
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
#3443 - answered here previously, basically a limitation of the API afaik |
Beta Was this translation helpful? Give feedback.
-
|
Is this not just a matter of adding the origin to the API call? |
Beta Was this translation helpful? Give feedback.
-
|
when I wrote the widget, no, that didn't work as it didnt return all of the correct alerts |
Beta Was this translation helpful? Give feedback.
-
|
Interesting, I may be misunderstanding what the correct "alerts" are, but I observed the following. |
Beta Was this translation helpful? Give feedback.
-
|
I think that if you choose the origin = CAPI, you'll get all the results available from the website of crowdsec so it will display the IP purged / deleted locally and also the blocklists downloaded, that's why the results are not "right" compared to local decisions. |
Beta Was this translation helpful? Give feedback.
-
|
I was seeing this too, so I just switched to using the prometheusmetric widget for crowdsec data, it works really well, assuming you already have Prometheus setup. |
Beta Was this translation helpful? Give feedback.
-
|
This discussion has been automatically closed due to lack of community support. See our contributing guidelines for more details. |
Beta Was this translation helpful? Give feedback.
-
|
Sad |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Description
Basically, I'm dealing with the same issue that was already discussed in Discussions 3443.
I see 100 alerts in the widget, but there should only be 1 alert at the moment.
As already mentioned in the other discussion, updates from individual blocklists are also displayed in the widget as alerts, which I personally don't find particularly helpful.
I don't think the widget is very useful if all alerts are displayed.
Would it be possible for the widget to filter the alerts better? Possibly as an option?
There is also an error in the Homepage log because of the size of the alert list:
API response for /api/services/proxy?type=crowdsec&group=Services&service=Crowdsec&endpoint=alerts exceeds 4MB. API Routes are meant to respond quickly. https://nextjs.org/docs/messages/api-routes-response-size-limitHere is an example from my system that shows the difference between the alerts:
Update:
│ 376 │ crowdsecurity/community-blocklist (47 Ips) │ update : +15000/-0 IPs │ │ │ ban:47 │ 2024-05-10 18:40:56 +0000 UTC │Real Ban:
│ 375 │ Ip:***.***.***.*** │ firewallservices/pf-scan-multi_ports │ DE │ 40021 NL-811-40021 │ ban:1 │ 2024-05-10 17:17:55.444260169 +0000 UTC │Thanks in advance
Other
No response
Beta Was this translation helpful? Give feedback.
All reactions