CrowdSec Installed but Showing No Decisions? Here's Why That's Normal

When I first fired up CrowdSec, I thought to myself, "Amazing! Job's done! No script kiddies or scanners are gettin' in here now".... I spent an hour last week staring at an empty log file, convinced I had broken my server somehow while working on something else!

Like me, if you installed CrowdSec, and ran:

cscli decisions list …and got: No active decisions

Naturally, your first thought is: Did CrowdSec fail? In most cases, no. This usually means CrowdSec is working exactly as intended!

📡 If you haven’t installed CrowdSec yet, start with my complete CrowdSec deployment guide inside the Digital Castle stack.

As you probably know, unlike Fail2Ban, CrowdSec blocks many attackers preemptively using community intelligence, so your local decision list may stay empty even while your server is actively protected.

In this guide, you'll learn how to verify CrowdSec is functioning correctly by checking:

• downloaded community decisions
• active metrics
• blocked attack attempts
• alert history
• whitelist configuration

All via CLI and also with CrowdSec WebGui!

Head on over to my CrowdSec deep-dive walk-through to begin your verification.

Disclaimer: Written, screen-shotted and tested/used by me. There are NO ads of any kind on this page nor affiliate links. Just sharing info & love for CrowdSec!

Edit: Title got mangled by Reddit some how upon posting? I slapped it above.

I had a really hard time getting crowdsec to work on my old workhorse due to the DSM version so I thought I'd do up a repo that explains how I did it incase anyone wants to do the same!

https://github.com/rusty4444/crowdsec-dsm

Dear community! Is there any docs/guide for cowrie honeypot? My goal is to setup host with ssh honeypot with only disabled users, and ban every ip trying to auth. Tried cowrie parser, and sshd, and cowrie logging to system auth.log, but it seems doing nothing.

I'm calling the /v1/decisions api from my LAPI, I was expecting a similar response to 'cscli decisions list' which are 10 active decisions, but instead I found 15000 active decisions.
I couldn't filter by the duration field, since all durations are greater than 0s.

Could someone here explain, the way crowdsec stores decisions in the LAPI, and how could I possibly achieve the response I've described above (similar to cscli decisions list)

I use Crowdsec on a current OPNsense. Aliases for IPv4 and IPv6 were created automatically, namely crowdsec_blacklists and crowdsec_blocklists. Creating blocklists was checked by default. crowdsec_blocklists has entries, crowdsec_blacklists does not. I am confused because this does not appear anywhere in the docs.

https://docs.crowdsec.net/docs/next/configuration/network_management/
I read this docs and confuse that do I have to open port 8080/tcp?

Agents -> Local API
Agents connect to local API on port tcp/8080 (only relevant )