I installed crowdsec on a Debian 11 (and 12) machine and it works but the geoip localization.
If I do:
# cscli collections list
INFO[19-09-2021 10:16:20 AM] Ignoring file /etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml of type parsers
---------------------------------------------
NAME STATUS VERSION LOCAL PATH
---------------------------------------------
[...]
crowdsecurity/linux ✔️ enabled 0.2 /etc/crowdsec/collections/linux.yaml
[...]
---------------------------------------------
I can see the linux collection is enabled, but the geoip-entich.yaml is ignored for some obscure reason.
If I do:
# cscli parsers list
I do not see the parser in the list.
Then, if I do:
# cscli parsers install crowdsecurity/geoip-enrich
INFO[19-09-2021 10:26:23 AM] Ignoring file /etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml of type parsers
FATA[19-09-2021 10:26:23 AM] unable to retrive item : crowdsecurity/geoip-enrich
I see it's unable to retrive item crowdsecurity/geoip-enrich but I can't not see why.
The geoip database is installed:
ii geoip-database 20191224-3 all IP lookup command line tools that use the GeoIP library (country database)
Any idea?
Thanks,
Matteo