Adding a new Acquisition
We will be adding a file based acquisition. If you need to use a different source then alter the instructions to match your needs.
Once you have found service you want to add, you can use the cscli
command line tool to add the collection.
You can view the available collections on the Hub.
- Linux/Freebsd
- Windows
- Kubernetes
cscli collections add <collection_name>
cscli.exe collections add <collection_name>
# In your values.yml file
agent:
env:
- name: COLLECTIONS
value: '<collection_name>'
Once the collection has been downloaded we need to add a new Acquisition to the configuration so CrowdSec knows where to find the log source.
An example of an Acquisition is available in the collection on the Hub, which will assist you in identifying the files to monitor and the labels to assign.
From version 1.5.0
we have added the ability to add acquisitions via the acquis.d
directory. This allows you to add acquisitions without modifying the main configuration file.
Create the directory if it does not exist
- Linux/Freebsd
- Windows
- Kubernetes
sudo mkdir -p /etc/crowdsec/acquis.d
- Powershell
- CMD
New-Item -ItemType Directory -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\
mkdir C:\ProgramData\CrowdSec\Config\acquis.d\
Code snippet not available for Kubernetes
Create the acquisition file
- Linux/Freebsd
- Windows
- Kubernetes
sudo touch /etc/crowdsec/acquis.d/<collection_name>.yaml
- Powershell
- CMD
New-Item -ItemType File -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml
.>C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml 2>NUL
# In your values.yml file
agent:
# -- To add custom acquisitions using available datasources (https://docs.crowdsec.net/docs/next/data_sources/intro)
additionalAcquisition:
- source: file
filenames:
- '/path/to/your/file.log' ## Single file
- '/path/to/your/files*' ## Wildcard support
labels:
type: '<type of logs>' ## Type defined in the parser
You can skip the following step if you are on Kubernetes
Add the following contents to the file
filenames:
- "/path/to/your/file.log" ## Single file
- "/path/to/your/files*" ## Wildcard support
labels:
type: "<type of logs>" ## Type defined in the parser
Once you have added the acquisitions you can test the configuration and restart the service.
- Linux/Freebsd
- Windows
- Kubernetes
sudo crowdsec -t && sudo systemctl restart crowdsec
- Powershell
- CMD
Restart-Service crowdsec
net stop crowdsec && net start crowdsec
helm upgrade -f values.yaml crowdsec crowdsecurity/crowdsec
Next Steps?
Now that you have added a new acquisition, you may want to verify that the logs are being parsed correctly see are detected log sources working correctly?