Tink vs CrowdSec
CrowdSec is the crowd-sourced ban engine. It parses logs, matches scenarios, and tells a bouncer to block the IP. It is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
CrowdSec bans IPs. Tink answers “why is this VPS sick?”
Accidental sysadmins land on CrowdSec because cscli decisions list shows who got blocked after a brute-force wave. Then disk is at 91%, nginx dies, and last night's community IPs do not say what to run. A filling /var is a Tink warning; it is not a decision.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using CrowdSec if you already want crowd-sourced IP bans on SSH. Use Tink if you run Linux servers and want a mechanic. They can sit on the same box.
| Feature | Tink | CrowdSec |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Install crowdsec, pick collections, a bouncer, and whether the console is in the loop |
| What you get | Working monitoring, diagnosis, and approved fixes | Decisions + bouncers from log scenarios — ban, captcha, and community IPs. Not a fleet mechanic |
| Pricing | Free (Scout) / $9 / $29 per machine per month | Open source engine. Console and extra seats are extra. You still pay the person who tunes scenarios after the outage |
| Hidden costs | None — fully managed | Collection drift, bouncer vs nftables, AppSec, and whether anyone watched disk while IPs were being banned |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Log parsers + scenarios + bouncers. CrowdSec does not watch fill time or propose a restart |
| Configuration | None after install — heuristics and AI | Collections, parsers, scenarios, bouncers, and whether acquis.yaml matches this distro's log path |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | No — you read cscli decisions and bouncer counters yourself |
| Fix execution | Proposes and executes approved commands with an audit trail | Blocks IPs only — CrowdSec cannot restart nginx, free disk, or rotate a cert |
| Alerting | Built-in across 8 channels | Optional console/webhook on a decision. Paging the rest of the box is extra |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Live decisions only — CrowdSec does not forecast fill time or a quiet NIC going bad later |
| SSH brute-force detection | Built-in — parses auth.log every scan | Yes for SSH scenarios — that is the job. It still will not say the disk is at 91% |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | If the host is down, CrowdSec is down too — no presence ping to Telegram |
| Public status page | Shareable URL with 90-day history | Not included — CrowdSec has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | Not included — a decision list is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire something else into PagerDuty |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | SSH + cscli. No mechanic you text when /var filled |
| Learning curve | None — works after install | Low to start sshd collection; higher to keep bouncers, AppSec, and parsers honest |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Operators who already want crowd-sourced IP decisions and will still SSH in when the box is sick |
When CrowdSec is the right choice
Keep using CrowdSec when you already want that exact job:
- Crowd-sourced bans — you need decisions and bouncers from shared IPs, not a fleet digest.
- Host-oriented — CrowdSec reads logs and talks to a bouncer; it is not a mechanic.
- No extra service — an engine you install on the box, not a hub, SaaS mechanic, or Telegram bot.
- No conversation layer wanted — some operators prefer cscli and will never use a mechanic.
The real cost of “just run CrowdSec”
The package is cheap to install. A working ops loop for five Linux boxes is not:
- A complete sshd scenario still means you SSH into the host and change the box by hand when it gets sick
- Host fill, nginx, certs, and a quiet agent never appear unless you built extra checks
- A filling /var is a Tink disk warning on every scan — CrowdSec stays a decision list until you are looking
- A single VPS with nobody logged in still needs a mechanic, not another banned /24
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who opens cscli after the outage, and every scan includes a diagnosis a quiet decision list will not type.
No SSH homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs lsof · Tink vs ss · Tink vs tcpdump