Vaultwarden Collection

Now we have to tell Vaultwarden to write its log file to the shared folder, so that CrowdSec can parse it and respond accordingly.

First, edit your Vaultwarden docker template, to map the Vaultwarden log output folder to the shared folder :

Add these extra parameters to your Vaultwarden template, enable the "advanced view" when editing your container, by clicking the upper right "basic view" slider :

-e LOG_FILE=/log/vaultwarden.log -e LOG_LEVEL=warn -e EXTENDED_LOGGING=true

Like this :

Restart your Vaultwarden container.

Edit your docker CrowdSec template to enable Vaultwarden collection, by adding Dominic-Wagner/vaultwarden to the COLLECTIONS variable :

Finally, edit your acquis.yml file in your CrowdSec's appdata folder (appdata/crowdsec) to add these lines : (don't leave any empty spaces)

---
filenames:
 - /var/log/crowdsec/vaultwarden.log
labels:
  type: vaultwarden

Restart CrowdSec container.

Use the "Useful Commands" cscli collections list and cscli metrics to check your collections and metrics, that should be ok!