Adding a new Acquisition

info

We will be adding a file based acquisition. If you need to use a different source then alter the instructions to match your needs.

Once you have found service you want to add, you can use the cscli command line tool to add the collection.

tip

You can view the available collections on the Hub.

Linux/Freebsd

cscli collections add <collection_name>

Windows

cscli.exe collections add <collection_name>

Kubernetes

# In your values.yml file
agent:
  env:
    - name: COLLECTIONS
      value: '<collection_name>'

Once the collection has been downloaded we need to add a new Acquisition to the configuration so CrowdSec knows where to find the log source.

info

An example of an Acquisition is available in the collection on the Hub, which will assist you in identifying the files to monitor and the labels to assign.

info

From version 1.5.0 we have added the ability to add acquisitions via the acquis.d directory. This allows you to add acquisitions without modifying the main configuration file.

Create the directory if it does not exist

Linux/Freebsd

sudo mkdir -p /etc/crowdsec/acquis.d

Windows

Powershell

New-Item -ItemType Directory -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\

CMD

mkdir C:\ProgramData\CrowdSec\Config\acquis.d\

Kubernetes

Code snippet not available for Kubernetes

Create the acquisition file

Linux/Freebsd

sudo touch /etc/crowdsec/acquis.d/<collection_name>.yaml

Windows

Powershell

New-Item -ItemType File -Force -Path C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml

CMD

.>C:\ProgramData\CrowdSec\Config\acquis.d\<collection_name>.yaml 2>NUL

Kubernetes

# In your values.yml file
agent:
# -- To add custom acquisitions using available datasources (https://docs.crowdsec.net/docs/next/data_sources/intro)
  additionalAcquisition:
    - source: file
      filenames:
        - '/path/to/your/file.log' ## Single file
        - '/path/to/your/files*' ## Wildcard support
      labels:
        type: '<type of logs>' ## Type defined in the parser

info

You can skip the following step if you are on Kubernetes

Add the following contents to the file

<collection_name>.yaml

filenames:
  - "/path/to/your/file.log" ## Single file
  - "/path/to/your/files*" ## Wildcard support
labels:
  type: "<type of logs>" ## Type defined in the parser

Once you have added the acquisitions you can test the configuration and restart the service.

Linux/Freebsd

sudo crowdsec -t && sudo systemctl restart crowdsec

Windows

Powershell

Restart-Service crowdsec

CMD

net stop crowdsec && net start crowdsec

Kubernetes

helm upgrade -f values.yaml crowdsec crowdsecurity/crowdsec

Next Steps?

Now that you have added a new acquisition, you may want to verify that the logs are being parsed correctly see are detected log sources working correctly?