Repository navigation
[BUG] crowdsec bouncer trying to send metrics to central crowdsec instance but failing #1046
Closed as not planned
Description
Is there an existing issue for this?
- I have searched the existing issues
Name of mod
linuxserver/mods:swag-crowdsec
Name of base container
swag
Current Behavior
Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.feature_flags of type []string" func=UsageMetrics
swag 172.18.0.1 ✔️ 2025-06-27T06:28:16Z crowdsec-nginx-bouncer v1.1.1 api-key
It seems that the bouncer version in swag (1.1.1) is too old and central Crowdsec is expecting a newer version for handling the metrics
Expected Behavior
metrics successfully sending to central Crowdsec instance
Steps To Reproduce
running both swag + mod & crowdsec latest images, this error comes up regularly.
I cannot update the bouncer version inside the swag container/image.
Environment
- OS: Pi4 debian bookworm
- How docker service was installed: aptCPU architecture
arm64
Docker creation
swag/crowdsec bouncer instance:
image: lscr.io/linuxserver/swag:latest
container_name: swag
cap_add:
- NET_ADMIN
environment:
- PUID=1000
- PGID=1000
- TZ=Europe/Berlin
- URL=xxx
- VALIDATION=http # dns
- SUBDOMAINS=xxx
- ONLY_SUBDOMAINS=false
- EMAIL=xxx
- SWAG_AUTORELOAD=true # optional
- SWAG_AUTORELOAD_WATCHLIST=/config/nginx/site-confs,/config/nginx/proxy-confs,/config/keys,/config/nginx/ip-blocks,/config/fail2ban/filter.d # optional
- DOCKER_MODS=linuxserver/mods:swag-dashboard|linuxserver/mods:swag-maxmind|linuxserver/mods:swag-crowdsec|linuxserver/mods:swag-geoip2influx
- MAXMINDDB_LICENSE_KEY=${MAXMINDDB_LICENSE_KEY}
- MAXMINDDB_USER_ID=${MAXMINDDB_USER_ID}
- INFLUX_DATABASE=geoip2influx
- INFLUX_USER=unpoller
- INFLUX_PASS=${INFLUX_PASS}
- INFLUX_URL=http://192.168.2.66:8086
- INFLUX_HOST=192.168.2.66
- INFLUX_HOST_PORT=8086
- INFLUX_RETENTION=7d
- USE_INFLUXDB_V2=false
- GEOIP2INFLUX_LOG_LEVEL=info
- CROWDSEC_API_KEY=xxx
- CROWDSEC_LAPI_URL=http://192.168.2.66:8484
- CROWDSEC_F2B_DISABLE=false
central instance:
rowdsec:
image: crowdsecurity/crowdsec:latest
container_name: crowdsec
ports:
- "8484:8080" # LAPI
- "6060:6060" # Exponiere den Prometheus-Endpunkt
volumes:
- ./crowdsec/data:/var/lib/crowdsec/data
- ./crowdsec/config:/etc/crowdsec
- /home/pi/docker/swag/config/log:/var/log/swag:ro
- /home/pi/docker/mailu/logs:/mailu_logs:ro
- /var/log:/host_logs:ro
environment:
- TZ=Europe/Berlin
restart: unless-stoppedContainer logs
time="2025-06-27T08:46:26+02:00" level=info msg="Sent 1 usage metrics"
time="2025-06-27T08:47:07+02:00" level=info msg="flushed 1/243 alerts because they were created 168h0m0s ago or more"
time="2025-06-27T08:47:10+02:00" level=error msg="Failed to bind json: json: cannot unmarshal object into Go struct field AllMetrics.remediation_components.feature_flags of type []string" func=UsageMetrics
time="2025-06-27T08:47:10+02:00" level=info msg="172.18.0.1 - [Fri, 27 Jun 2025 08:47:10 CEST] \"POST /v1/usage-metrics HTTP/1.1 400 1.620495ms \"crowdsec-nginx-bouncer/v1.1.1\" \""
time="2025-06-27T08:47:11+02:00" level=info msg="127.0.0.1 - [Fri, 27 Jun 2025 08:47:11 CEST] \"GET /v1/heartbeat HTTP/1.1 200 52.709691ms \"crowdsec/v1.6.9-40b8cfe6-docker\" \""
time="2025-06-27T08:48:11+02:00" level=info msg="127.0.0.1 - [Fri, 27 Jun 2025 08:48:11 CEST] \"GET /v1/heartbeat HTTP/1.1 200 54.0445ms \"crowdsec/v1.6.9-40b8cfe6-docker\" \""
time="2025-06-27T08:49:11+02:00" level=info msg="127.0.0.1 - [Fri, 27 Jun 2025 08:49:11 CEST] \"GET /v1/heartbeat HTTP/1.1 200 51.205891ms \"crowdsec/v1.6.9-40b8cfe6-docker\" \""
time="2025-06-27T08:49:19+02:00" level=info msg="capi metrics: sending"
Activity
Bidonh commentedon Jun 28, 2025
Hello, I don't have this problem sending metrics.
but I know you can choose Crowdsec bouncer version in Swag with an environnement variable.
I used it before to fix the " Invalid tarball" error.
bondskin commentedon Jul 2, 2025
Thanks @Bidonh,
This is what I see in the Crowdsec website
My Swag in a container is 4.1.1-ls392
Bidonh commentedon Jul 3, 2025
This is what I see and the unknown version inactive is apparently not a bug.
The crowdsec nginx bouncer should be v1.1.2.
In my log, I don't see any reference to crowdsec-nginx-bouncer at all, I am on a Synology not a Pi4.
In my docker compose I use:
Have you tried to delete the docker images, pulling again them from the repositories and building the containers again ?
bondskin commentedon Jul 7, 2025
thanks @Bidonh , my ngin-bouncer comes as a mod within SWAG and I cannot update it by my own.
I think I will open a new issue to clarify, when SWA will update the Crowdsec mod to include latest v 1.1.2
LinuxServer-CI commentedon Aug 6, 2025
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.
LinuxServer-CI commentedon Nov 5, 2025
This issue is locked due to inactivity