Fwd: logwatch 7.3.1 patch for fail2ban
"Kirk Bauer" <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
---------- Forwarded message ---------- From: Paul Gear <[email protected]> Date: 2008/6/23 Subject: logwatch 7.3.1 patch for fail2ban To: [email protected] Hi Kirk & logwatch team, I'm using logwatch 7.3.1-5 from Debian stable along with fail2ban 0.8.2-3~bpo40+1 from Debian backports, and it is very noisy by default. Attached is a patch that brings it more into line with the usual behaviour of logwatch. I've tested with a detail level of 4 for fail2ban. Regards, Paul -- Kirk Bauer <[email protected]> http://linux.kaybee.org | www.logwatch.org Author, Automating UNIX & Linux Administration _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
logwatch-fail2ban.patch
(text/x-patch, 2.3 KB)
Index: scripts/services/fail2ban
===================================================================
--- scripts/services/fail2ban (revision 30)
+++ scripts/services/fail2ban (working copy)
@@ -20,6 +20,7 @@
my $DebugCounter = 0;
my $ReInitializations = 0;
my @IptablesErrors = ();
+my @ActionErrors = ();
my $NotValidIP = 0; # reported invalid IPs number
my @OtherList = ();
@@ -39,6 +40,7 @@
if ( ($ThisLine =~ /..,... DEBUG: /) or
($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
+ ($ThisLine =~ /INFO.*Log rotation detected for/) or
($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban
($ThisLine =~ /..,... WARNING: Verbose level is /) or
($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
@@ -60,10 +62,14 @@
push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
} elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
$ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+ } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
+ $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
} elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
$ServicesBans{$Service}{$Host}{'ReBan'}++;
} elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) {
push @IptablesErrors, "$ThisLine\n";
+ } elsif ($ThisLine =~ /ERROR.*returned \d+$/) {
+ push @ActionErrors, "$ThisLine\n";
} elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or
($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
$ReInitializations++;
@@ -119,6 +125,13 @@
print @IptablesErrors ;
}
}
+ if ($#ActionErrors > 0) {
+ printf("\n%d error(s) returned from actions", $#ActionErrors);
+ if ($Detail > 5) {
+ print ":\n";
+ print @ActionErrors ;
+ }
+ }
if ($ReInitializations > 0) {
printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
}
paul.vcf
(text/x-vcard, 270 B)
begin:vcard fn:Paul Gear n:Gear;Paul org:Liberty Systems & Software adr;dom:;;;Birkdale;Q;4159 email;internet:[email protected] title:Director tel;work:07 3122 2198 tel;cell:04 3183 7656 x-mozilla-html:FALSE url:http://www.libertysys.com.au/ version:2.1 end:vcard
smime.p7s
(application/x-pkcs7-signature, 4.5 KB) - not displayed