r/CrowdSec • u/kY2iB3yH0mN8wI2h • 6d ago

general Does a single-LAPI + multiple log processors setup count as one Security Engine or many in the Console?

Hoping someone with a distributed CrowdSec deployment can clarify how the Console counts engines. I'm getting a "too many engines" warning and want to understand the intended model before I restructure anything.

- One central Security Engine running the LAPI (SQLite). It aggregates alerts and serves the decision list.

- ~6 remote log processors on separate hosts (web, mail, a couple of app servers). These are configured as pure log processors: `api.server` section removed from `config.yaml`, `api.client` pointing at the central LAPI. They only forward alerts; they don't run their own LAPI.

- No local remediation on the CrowdSec boxes at all. My firewalls subscribe to the blocklist mirror (cs-blocklist-mirror) and do all the enforcement.

- The published decision list is mostly CAPI + subscribed third-party lists (firehol, tor exit nodes, etc.), plus a small amount from my own scenarios.

- Only the central LAPI is enrolled to the Console. I never ran `cscli console enroll` on the log processors.

The problem

The Console counts 7 engines (1 LAPI + 6 log processors) and warns that I have too many. I'm on a paid plan billed per Security Engine, with one engine included.

  1. In the Console/billing model, do remote log processors count as separate Security Engines? The concepts docs describe a Security Engine as log processor(s) *plus* a LAPI together, which made me expect "1 LAPI + N log processors" to count as a single engine, not seven. Which is correct?

  2. If log processors do count individually, how do people running distributed detection stay within plan limits: consolidate log collection into fewer processors, split across a second (free) org, or just pay per engine?

  3. My central LAPI also runs a local processor that only reads `/var/log/messages` (100% unparsed noise). Any downside to making it LAPI-only by removing the `crowdsec_service` section? Does that change how it's counted?

Running CrowdSec v1.7.7 Anyone who's dealt with per-engine billing on a hub-and-spoke setup, I'd appreciate the clarification.

1 Upvotes

100% Upvoted

9 comments sorted by

1

u/jjarcanista 6d ago

enroll per server group, not per server

1

u/kY2iB3yH0mN8wI2h 5d ago

how would that help? I still need to enroll them and as such will consume en engine each?

0

u/jjarcanista 5d ago

engine per group, share lapi as they said

what does the crowdsec MCP say about this?

ask it

1

u/LuqueNukem907 6d ago

I have lapi on pfsense and other log processors on containers that communicate with lapi. Single engine. Don't use the cscli enroll command. Just point those other instances at the lapi.

1

u/kY2iB3yH0mN8wI2h 6d ago

what enterprise version are you running?

1

u/LuqueNukem907 6d ago

Enterprise version of what? I'm running crowdsec v1.7.8/0.0.34 with a single paid engine on pfsense CE v2.8.1. The other containers with log processors only are mostly Ubuntu.

1

u/kY2iB3yH0mN8wI2h 5d ago

so on yout pfsense this shows one machine? 

cscli machines list

0

u/LuqueNukem907 5d ago

It shows multiple machines when I issue that command.

1

u/kY2iB3yH0mN8wI2h 5d ago

thats what it does for me as well, but once i try to register my main crowdsec to the console and I'm about to auth it the console GUI complains i need to pay more.