SF.net SVN: logwatch:[301] trunk
[email protected] Mon, 30 Nov 2015 20:53:31 +0000
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
Revision: 301
http://sourceforge.net/p/logwatch/code/301
Author: opoplawski
Date: 2015-11-30 20:53:31 +0000 (Mon, 30 Nov 2015)
Log Message:
-----------
[fail2ban] Handle different log sources
- Apply fixes from https://sourceforge.net/p/logwatch/patches/38/
- Collect generic messages by level
Modified Paths:
--------------
trunk/conf/services/fail2ban.conf
trunk/scripts/services/fail2ban
Modified: trunk/conf/services/fail2ban.conf
===================================================================
--- trunk/conf/services/fail2ban.conf 2015-11-23 17:26:20 UTC (rev 300)
+++ trunk/conf/services/fail2ban.conf 2015-11-30 20:53:31 UTC (rev 301)
@@ -18,7 +18,15 @@
# Which logfile group...
LogFile = fail2ban
+LogFile = messages
+# Only give lines pertaining to the fail2ban service. Don't use
+# OnlyService because fail2ban.log does not use the syslog format.
+# Note: fail2ban logs using "service" names fail2ban, fail2ban.jail,
+# fail2ban.filter, and many more. We want to exclude fail2ban-client
+# so we reject fail2ban-
+*OnlyContains = fail2ban([^-]|).*\[[0-9]+\]
+
# Cannot use *OnlyService or *RemoveHeaders in cases where fail2ban logs
# to fail2ban.log due to different date/header format. You can if fail2ban
# is logging to syslog.
Modified: trunk/scripts/services/fail2ban
===================================================================
--- trunk/scripts/services/fail2ban 2015-11-23 17:26:20 UTC (rev 300)
+++ trunk/scripts/services/fail2ban 2015-11-30 20:53:31 UTC (rev 301)
@@ -47,76 +47,89 @@
my $ReInitializations = 0;
my @IptablesErrors = ();
my @ActionErrors = ();
-my $NotValidIP = 0; # reported invalid IPs number
-my @OtherList = ();
+my $NotValidIP = 0; # reported invalid IPs number
+my %ErrorList = ();
+my %WarningList = ();
+my %InfoList = ();
+my %NoticeList = ();
+my %OtherList = ();
my %ServicesBans = ();
my %ServicesFound = ();
my %ServicesIgnored = ();
if ( $Debug >= 5 ) {
- print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n";
- $DebugCounter = 1;
+ print STDERR "\n\nDEBUG: Inside Fail2Ban Filter \n\n";
+ $DebugCounter = 1;
}
while (defined(my $ThisLine = <STDIN>)) {
if ( $Debug >= 5 ) {
- print STDERR "DEBUG($DebugCounter): $ThisLine";
- $DebugCounter++;
+ print STDERR "DEBUG($DebugCounter): $ThisLine";
+ $DebugCounter++;
}
chomp($ThisLine);
if ( ($ThisLine =~ /..,... DEBUG: /) or
- ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
- ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
- ($ThisLine =~ /INFO\s+Log rotation detected for/) or
- ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses )/) or
- ($ThisLine =~ /INFO\s+Changed logging target to/) or
- ($ThisLine =~ /INFO\s+Creating new jail/) or
- ($ThisLine =~ /INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using|Connected to |rollover performed)/) or # syntax of 0.7.? fail2ban
- ($ThisLine =~ /..,... WARNING: Verbose level is /) or
- ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) or
- ($ThisLine =~ /WARNING Determined IP using DNS Lookup: [^ ]+ = \['[^']+'\]/) or
- ($ThisLine =~ /INFO\s+(Stopping all jails|Exiting Fail2ban)/) or
- ($ThisLine =~ /INFO\s+Initiated '.*' backend/) or
- ($ThisLine =~ /INFO\s+(Added logfile = .*|Set maxRetry = \d+|Set findtime = \d+|Set banTime = \d+)/)
+ ($ThisLine =~ /..,... \S*\s*: DEBUG /) or # syntax of 0.7.? fail2ban
+ ($ThisLine =~ /..,... INFO: (Fail2Ban v.* is running|Exiting|Enabled sections:)/) or
+ ($ThisLine =~ /INFO\s+Log rotation detected for/) or
+ ($ThisLine =~ /INFO\s+Jail.+(?:stopped|started|uses )/) or
+ ($ThisLine =~ /INFO\s+Changed logging target to/) or
+ ($ThisLine =~ /INFO\s+Creating new jail/) or
+ ($ThisLine =~ /INFO\s+(Set |Socket|Exiting|Gamin|Created|Added|Using|Connected to |rollover performed)/) or # syntax of 0.7.? fail2ban
+ ($ThisLine =~ /..,... WARNING: Verbose level is /) or
+ ($ThisLine =~ /..,... WARNING: Restoring firewall rules/) or
+ ($ThisLine =~ /WARNING Determined IP using DNS Lookup: [^ ]+ = \['[^']+'\]/) or
+ ($ThisLine =~ /INFO\s+(Stopping all jails|Exiting Fail2ban)/) or
+ ($ThisLine =~ /INFO\s+Initiated '.*' backend/) or
+ ($ThisLine =~ /INFO\s+(Added logfile = .*|Set maxRetry = \d+|Set findtime = \d+|Set banTime = \d+)/)
)
{
- if ( $Debug >= 6 ) {
- print STDERR "DEBUG($DebugCounter): line ignored\n";
- }
- } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/(?:WARNING|NOTICE):?\s\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) {
- if ( $Debug >= 6 ) {
- print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n";
- }
- $ServicesBans{$Service}{$Host}{$Action}++;
- $ServicesBans{$Service}{"(all)"}{$Action}++;
+ if ( $Debug >= 6 ) {
+ print STDERR "DEBUG($DebugCounter): line ignored\n";
+ }
+ } elsif ( my ($Service,$Action,$Host) = ($ThisLine =~ m/(?:WARNING|NOTICE):?\s+\[?(.*?)[]:]?\s(Ban|Unban)[^\.]* (\S+)/)) {
+ if ( $Debug >= 6 ) {
+ print STDERR "DEBUG($DebugCounter): Found $Action for $Service from $Host\n";
+ }
+ $ServicesBans{$Service}{$Host}{$Action}++;
+ $ServicesBans{$Service}{"(all)"}{$Action}++;
} elsif ( my ($Service,$Host,$NumFailures) = ($ThisLine =~ m/INFO: (\S+): (.+) has (\d+) login failure\(s\). Banned./)) {
- if ($Debug >= 4) {
- print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n";
- }
- push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
+ if ($Debug >= 4) {
+ print STDERR "DEBUG: Found host $Host trying to access $Service - failed $NumFailures times\n";
+ }
+ push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures;
} elsif ( my ($Service,$Host) = ($ThisLine =~ m/ ERROR:\s(.*):\s(\S+)\salready in ban list/)) {
- $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
- } elsif ( my ($Service,$Host) = ($ThisLine =~ m/(?:INFO|WARNING)\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
- $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+ $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
+ } elsif ( my ($Service,$Host) = ($ThisLine =~ m/(?:INFO|WARNING|NOTICE)\s*\[(.*)\]\s*(\S+)\s*already banned/)) {
+ $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++;
} elsif ( my ($Service,$Host) = ($ThisLine =~ m/ WARNING:\s(.*):\sReBan (\S+)/)) {
- $ServicesBans{$Service}{$Host}{'ReBan'}++;
+ $ServicesBans{$Service}{$Host}{'ReBan'}++;
} elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) {
- push @IptablesErrors, "$ThisLine\n";
+ push @IptablesErrors, "$ThisLine\n";
} elsif ($ThisLine =~ /ERROR.*returned \d+$/) {
- push @ActionErrors, "$ThisLine\n";
+ push @ActionErrors, "$ThisLine\n";
} elsif (($ThisLine =~ /..,... WARNING: \#\S+ reinitialization of firewalls/) or
- ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
- $ReInitializations++;
+ ($ThisLine =~ / ERROR\s*Invariant check failed. Trying to restore a sane environment/)) {
+ $ReInitializations++;
} elsif ($ThisLine =~ /..,... WARNING: is not a valid IP address/) {
- # just ignore - this will be fixed within fail2ban and is harmless warning
+ # just ignore - this will be fixed within fail2ban and is harmless warning
} elsif ( my ($Service,$Host) = ($ThisLine =~ /INFO\s+\[(.*)\] Found (.*)/)) {
- $ServicesFound{$Service}{$Host}++;
+ $ServicesFound{$Service}{$Host}++;
} elsif ( my ($Service,$Host) = ($ThisLine =~ /INFO\s+\[(.*)\] Ignore (.*)/)) {
- $ServicesIgnored{$Service}{$Host}++;
+ $ServicesIgnored{$Service}{$Host}++;
+ # Generice messages
+ } elsif ( my ($Message) = ($ThisLine =~ / ERROR (.*)$/)) {
+ $ErrorList{$Message}++;
+ } elsif ( my ($Message) = ($ThisLine =~ / WARNING (.*)$/)) {
+ $WarningList{$Message}++;
+ } elsif ( my ($Message) = ($ThisLine =~ / INFO (.*)$/)) {
+ $InfoList{$Message}++;
+ } elsif ( my ($Message) = ($ThisLine =~ / NOTICE (.*)$/)) {
+ $NoticeList{$Message}++;
} else {
- # Report any unmatched entries...
- push @OtherList, "$ThisLine\n";
+ # Report any unmatched entries...
+ $OtherList{$ThisLine}++;
}
}
@@ -124,32 +137,32 @@
if (keys %ServicesBans) {
- printf("\nBanned services with Fail2Ban: Bans:Unbans\n");
+ printf("\nBanned services with Fail2Ban: Bans:Unbans\n");
foreach my $service (sort {$a cmp $b} keys %ServicesBans) {
- printf(" %-55s [%3d:%-3d]\n", "$service:",
- $ServicesBans{$service}{'(all)'}{'Ban'},
- $ServicesBans{$service}{'(all)'}{'Unban'});
- delete $ServicesBans{$service}{'(all)'};
- my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP);
- if ($Detail >= 5) {
- foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) {
- my $name = LookupIP($ip);
- printf(" %-53s %3d:%-3d\n",
- $name,
- $ServicesBans{$service}{$ip}{'Ban'},
- $ServicesBans{$service}{$ip}{'Unban'});
- if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) {
- print " Failed ";
- foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) {
- print " $fails";
- }
- print " times";
- printf("\n %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ;
- printf("\n %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ;
- print "\n";
- }
- }
- }
+ printf(" %-55s [%3d:%-3d]\n", "$service:",
+ $ServicesBans{$service}{'(all)'}{'Ban'},
+ $ServicesBans{$service}{'(all)'}{'Unban'});
+ delete $ServicesBans{$service}{'(all)'};
+ my $totalSort = TotalCountOrder(%{$ServicesBans{$service}}, \&SortIP);
+ if ($Detail >= 5) {
+ foreach my $ip (sort $totalSort keys %{$ServicesBans{$service}}) {
+ my $name = LookupIP($ip);
+ printf(" %-53s %3d:%-3d\n",
+ $name,
+ $ServicesBans{$service}{$ip}{'Ban'},
+ $ServicesBans{$service}{$ip}{'Unban'});
+ if (($Detail >= 10) and ($ServicesBans{$service}{$ip}{'Failures'}>0)) {
+ print " Failed ";
+ foreach my $fails (@{$ServicesBans{$service}{$ip}{'Failures'}}) {
+ print " $fails";
+ }
+ print " times";
+ printf("\n %d Duplicate Ban attempts", $ServicesBans{$service}{$ip}{'AlreadyInTheList'}) ;
+ printf("\n %d ReBans due to rules reinitilizations", $ServicesBans{$service}{$ip}{'ReBan'}) ;
+ print "\n";
+ }
+ }
+ }
}
}
@@ -157,9 +170,9 @@
printf("\nFail2Ban hosts found:\n");
foreach my $service (sort {$a cmp $b} keys %ServicesFound) {
print(" $service:\n");
- foreach my $ip (sort {$a cmp $b} keys %{$ServicesFound{$service}}) {
- printf(" %-15s (%3d Times)\n", "$ip",
- $ServicesFound{$service}{$ip});
+ foreach my $ip (sort {$a cmp $b} keys %{$ServicesFound{$service}}) {
+ printf(" %-15s (%3d Times)\n", "$ip",
+ $ServicesFound{$service}{$ip});
}
}
}
@@ -168,34 +181,65 @@
printf("\nFail2Ban hosts ignored:\n");
foreach my $service (sort {$a cmp $b} keys %ServicesIgnored) {
print(" $service:\n");
- foreach my $ip (sort {$a cmp $b} keys %{$ServicesIgnored{$service}}) {
- printf(" %-15s (%3d Times)\n", "$ip",
- $ServicesIgnored{$service}{$ip});
+ foreach my $ip (sort {$a cmp $b} keys %{$ServicesIgnored{$service}}) {
+ printf(" %-15s (%3d Times)\n", "$ip",
+ $ServicesIgnored{$service}{$ip});
}
}
}
+if (keys(%ErrorList)) {
+ print "\n** ERRORS **\n";
+ foreach my $line (sort {$a cmp $b} keys %ErrorList) {
+ print " $line: $ErrorList{$line} Time(s)\n";
+ }
+}
+
+if (keys(%WarningList)) {
+ print "\n** WARNINGS **\n";
+ foreach my $line (sort {$a cmp $b} keys %WarningList) {
+ print " $line: $WarningList{$line} Time(s)\n";
+ }
+}
+
+if (keys(%InfoList) && $Detail>5) {
+ print "\nInformational Messages:\n";
+ foreach my $line (sort {$a cmp $b} keys %InfoList) {
+ print " $line: $InfoList{$line} Time(s)\n";
+ }
+}
+
+if (keys(%NoticeList) && $Detail>7) {
+ print "\nNotices:\n";
+ foreach my $line (sort {$a cmp $b} keys %OtherList) {
+ print " $line: $OtherList{$line} Time(s)\n";
+ }
+}
+
if ($Detail>0) {
if ($#IptablesErrors > 0) {
- printf("\n%d faulty iptables invocation(s)", $#IptablesErrors);
- if ($Detail > 5) {
- print ":\n";
- print @IptablesErrors ;
- }
+ printf("\n%d faulty iptables invocation(s)", $#IptablesErrors);
+ if ($Detail > 5) {
+ print ":\n";
+ print @IptablesErrors ;
+ }
}
if ($#ActionErrors > 0) {
- printf("\n%d error(s) returned from actions", $#ActionErrors);
- if ($Detail > 5) {
- print ":\n";
- print @ActionErrors ;
- }
+ printf("\n%d error(s) returned from actions", $#ActionErrors);
+ if ($Detail > 5) {
+ print ":\n";
+ print @ActionErrors ;
+ }
}
if ($ReInitializations > 0) {
- printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
+ printf("\n%d fail2ban rules reinitialization(s)", $ReInitializations);
}
- if ($#OtherList >= 0) {
- print "\n**Unmatched Entries**\n";
- print @OtherList;
+}
+
+if (keys(%OtherList)) {
+ print "\n**Unmatched Entries**\n";
+ foreach my $line (sort {$a cmp $b} keys %OtherList) {
+ print " $line: $OtherList{$line} Time(s)\n";
}
}
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
------------------------------------------------------------------------------
Go from Idea to Many App Stores Faster with Intel(R) XDK
Give your users amazing mobile app experiences with Intel(R) XDK.
Use one codebase in this all-in-one HTML5 development environment.
Design, debug & build mobile apps & 2D/3D high-impact games for multiple OSs.
http://pubads.g.doubleclick.net/gampad/clk?id=254741911&iu=/4140