lookup www.arvancloud.ir on 192.168.1.254:53: no such host

[rhclayto]

What happened?

crowdsec-hubupdate.service fails with the following error message:

Apr 25 14:37:25 watcher hubupdate.sh[559513]: Error: cscli hub upgrade: while downloading data for /etc/crowdsec/postoverflows/s01-whitelist/cdn-arvan-whitelist.yaml: while getting data: failed http request for https://www.arvancloud.ir/en/ips.txt: Get "https://www.arvancloud.ir/en/ips.txt": dial tcp: lookup www.arvancloud.ir on 192.168.1.254:53: no such host

What did you expect to happen?

No failure.

How can we reproduce it (as minimally and precisely as possible)?

I updated with apt & after it restared this is what I got.

Anything else we need to know?

No response

Crowdsec version

Details

version: v1.7.7-debian-pragmatic-amd64-027974f2
Codename: alphaga
BuildDate: 2026-03-30_14:47:55
GoVersion: 1.25.8
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.7-debian-pragmatic-amd64-027974f2-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: cscli_setup, datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog, db_mysql, db_postgres, db_sqlite

OS version

Details

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Enabled collections and parsers

No response

Acquisition config

Details

# filenames:
#   - /var/log/nginx/*.log
#   #- ./tests/nginx/nginx.log
# #this is not a syslog log, indicate which kind of logs it is
# labels:
#   type: nginx
# ---
filenames:
 - /var/log/auth.log
 - /var/log/syslog
labels:
  type: syslog
---
source: journalctl
journalctl_filter:
 - "_SYSTEMD_UNIT=ssh.service"
labels:
  type: syslog
# ---
# filename: /var/log/apache2/*.log
# labels:
#   type: apache2
appsec_configs:
  - crowdsecurity/appsec-default # Virtual patching rules (in-band blocking).
  - crowdsecurity/crs # OWASP CRS rules (out-of-band remediation).
labels:
  type: appsec
listen_addr: 172.16.10.107:7422
#cert_file: /path/to/cert.crt
#key_file: /path/to/key.pem
source: appsec
name: watcherAppSecComponent
#log_level: debug # Holy shit.
source: journalctl
#log_level: debug
journalctl_filter:
 - "_SYSTEMD_UNIT=authelia.service"
 - "--file=/var/log/journal/remote/remote-172.16.10.104.journal"
labels:
  type: syslog
source: journalctl
#log_level: debug
journalctl_filter:
 - "_SYSTEMD_UNIT=dovecot.service"
 - "--file=/var/log/journal/remote/remote-172.16.10.108.journal"
labels:
  type: syslog
filenames:
  - /var/log/nginx/*.log
  #- ./tests/nginx/nginx.log
#this is not a syslog log, indicate which kind of logs it is
labels:
  type: nginx
---
source: journalctl
#log_level: debug
journalctl_filter:
 - "_SYSTEMD_UNIT=nginx.service"
 - "--file=/var/log/journal/remote/remote-172.16.10.101.journal"
 - "--file=/var/log/journal/remote/remote-172.16.10.109.journal"
labels:
  type: nginx
source: journalctl
#log_level: debug
journalctl_filter:
 - "_SYSTEMD_UNIT=postfix.service"
 - "--file=/var/log/journal/remote/remote-172.16.10.108.journal"
labels:
  type: syslog

Config show

Details

Global:
   - Configuration Folder   : /etc/crowdsec
   - Data Folder            : /var/lib/crowdsec/data
   - Hub Folder             : /etc/crowdsec/hub
   - Notification Folder    : /etc/crowdsec/notifications
   - Simulation File        : /etc/crowdsec/simulation.yaml
   - Log Folder             : /dev/null
   - Log level              : info
   - Log Media              : stdout
Crowdsec:
  - Acquisition File        : /etc/crowdsec/acquis.yaml
  - Parsers routines        : 1
  - Acquisition Folder      : /etc/crowdsec/acquis.d
cscli:
  - Output                  : human
  - Hub Branch              :
API Client:
  - URL                     : http://172.16.10.107:8088/
  - Login                   : watcher
  - Credentials File        : /etc/crowdsec/local_api_credentials.yaml
Local API Server:
  - Listen URL              : 0.0.0.0:8088
  - Listen Socket           :
  - Profile File            : /etc/crowdsec/profiles.yaml

  - Trusted IPs:
      - 127.0.0.1
      - ::1
      - 172.16.10.0/24
      - 10.0.3.1
      - 10.0.2.1
  - Database:
      - Type                : mysql
      - Host                : 172.16.40.105
      - Port                : 3306
      - User                : crowdsec
      - DB Name             : crowdsec
      - Max Open Conns      : 100
      - Flush age           : 168h0m0s
      - Flush size          : 5000

Prometheus metrics

Details

$ cscli metrics
# paste output here

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

Details

[github-actions]

@rhclayto: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.