Where Does CrowdSec Store Config and Data?
CrowdSec reads config.yaml in /etc/crowdsec with the SQLite database and hub items beside it.
Last updated
CrowdSec configures from YAML in /etc/crowdsec. The config.yaml file sets database paths and API credentials while acquis.yaml names log sources. Decisions and meta persist in a SQLite database beside them.
Hub collections download parsers and scenarios into the same tree. Bouncers read decisions through the local API rather than files. Back up the etc tree with the database for restores.
Where CrowdSec stores this, by platform
/etc/crowdsec/config.yaml
Database path plus API credentials live here. Log sources sit in acquis.yaml beside it. Decisions persist in SQLite nearby.
Frequently asked questions
How do I back up CrowdSec?
Copy the etc tree with the SQLite database. API credentials travel in the YAML files. Restore matching versions together.
Where are CrowdSec decisions?
In the SQLite database served through the local API. Bouncers query rather than read files. Inspect with cscli decisions commands.
Notice an outdated path? Let us know.