Attachment 845873 Details for Bug 1048639 – Proposed patch to fix logwatch processing for fail2ban

[patch] Proposed patch to fix logwatch processing for fail2ban

fail2ban.patch (text/plain), 2.44 KB, created by Edward Kuns on 2014-01-06 01:41:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Edward Kuns

Created: 2014-01-06 01:41:51 UTC

Size: 2.44 KB

patch

obsolete

>--- default.conf/services/fail2ban.conf.orig	2014-01-05 17:33:05.047017981 -0600
>+++ default.conf/services/fail2ban.conf	2014-01-05 19:18:54.673027474 -0600
>@@ -20,6 +20,11 @@
> Title = fail2ban-messages
> 
> # Which logfile group...
>-LogFile = fail2ban
>-
>+LogFile = messages
> 
>+# Only give lines pertaining to the fail2ban service...
>+# Note: fail2ban logs using "service" names fail2ban, fail2ban.jail,
>+# fail2ban.filter, and many more.  We want to exclude fail2ban-client
>+# so we accept either fail2ban or fail2ban\..+
>+*OnlyService = fail2ban(|\..+)
>+*RemoveHeaders
>--- scripts/services/fail2ban.orig	2013-05-22 07:54:49.000000000 -0500
>+++ scripts/services/fail2ban	2014-01-05 19:19:34.720473432 -0600
>@@ -67,12 +67,16 @@
> 	 ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
> 	 ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
> 	 ($ThisLine =~ /INFO\s+Log rotation detected for/) or
>-	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or
>+	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller|uses pyinotify)/) or
> 	 ($ThisLine =~ /INFO\s+Changed logging target to/) or
> 	 ($ThisLine =~ /INFO\s+Creating new jail/) or
> 	 ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban
> 	 ($ThisLine =~ /..,... WARNING: Verbose level is /) or
>-	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
>+	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) or
>+	 ($ThisLine =~ /WARNING Determined IP using DNS Lookup: [^ ]+ = \['[^']+'\]/) or
>+	 ($ThisLine =~ /INFO\s+(Stopping all jails|Exiting Fail2ban)/) or
>+	 ($ThisLine =~ /INFO\s+Initiated 'pyinotify' backend/) or
>+	 ($ThisLine =~ /INFO\s+(Added logfile = .*|Set maxRetry = \d+|Set findtime = \d+|Set banTime = \d+)/)
>        )
>     {
> 	if ( $Debug >= 6 ) {
>@@ -91,7 +95,7 @@
> 	push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
>     } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
>    	 $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
>-    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
>+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/INFO\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
>        $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
>     } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
> 	    $ServicesBans{$Service}{$Host}{'ReBan'}++;

Actions: View | Diff

Attachments on bug 1048639: 845873 | 948123