SF.net SVN: logwatch:[205]

Revision: 205
          http://sourceforge.net/p/logwatch/code/205
Author:   stefjakobs
Date:     2014-09-08 19:15:49 +0000 (Mon, 08 Sep 2014)
Log Message:
-----------
ignore some more lines from fail2ban (Thanks Edward Kuns)

Modified Paths:
--------------
    conf/services/fail2ban.conf
    scripts/services/fail2ban

Modified: conf/services/fail2ban.conf
===================================================================
--- conf/services/fail2ban.conf	2014-09-08 15:49:35 UTC (rev 204)
+++ conf/services/fail2ban.conf	2014-09-08 19:15:49 UTC (rev 205)
@@ -22,4 +22,9 @@
 # Which logfile group...
 LogFile = fail2ban
 
-
+# Only give lines pertaining to the fail2ban service...
+# Note: fail2ban logs using "service" names fail2ban, fail2ban.jail,
+# fail2ban.filter, and many more.  We want to exclude fail2ban-client
+# so we accept either fail2ban or fail2ban\..+
+*OnlyService = fail2ban(|\..+)
+*RemoveHeaders

Modified: scripts/services/fail2ban
===================================================================
--- scripts/services/fail2ban	2014-09-08 15:49:35 UTC (rev 204)
+++ scripts/services/fail2ban	2014-09-08 19:15:49 UTC (rev 205)
@@ -67,12 +67,16 @@
 	 ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
 	 ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
 	 ($ThisLine =~ /INFO\s+Log rotation detected for/) or
-	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller)/) or
+	 ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses poller|uses pyinotify)/) or
 	 ($ThisLine =~ /INFO\s+Changed logging target to/) or
 	 ($ThisLine =~ /INFO\s+Creating new jail/) or
 	 ($ThisLine =~ /..,... \S+\s*: INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using)/) or # syntax of 0.7.? fail2ban
 	 ($ThisLine =~ /..,... WARNING: Verbose level is /) or
-	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/)
+	 ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) or
+	 ($ThisLine =~ /WARNING Determined IP using DNS Lookup: [^ ]+ = \['[^']+'\]/) or
+	 ($ThisLine =~ /INFO\s+(Stopping all jails|Exiting Fail2ban)/) or
+	 ($ThisLine =~ /INFO\s+Initiated 'pyinotify' backend/) or
+	 ($ThisLine =~ /INFO\s+(Added logfile = .*|Set maxRetry = \d+|Set findtime = \d+|Set banTime = \d+)/)
        )
     {
 	if ( $Debug >= 6 ) {
@@ -91,7 +95,7 @@
 	push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
     } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
    	 $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
-    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/WARNING\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
+    } elsif ( my ($Service,$Host) = ($ThisLine =~ m/(?:INFO|WARNING)\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
        $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
     } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
 	    $ServicesBans{$Service}{$Host}{'ReBan'}++;

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Want excitement?
Manually upgrade your production database.
When you want reliability, choose Perforce
Perforce version control. Predictably reliable.
http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk