fail2ban and systemd-journald
Monsieur Me via Logwatch-devel <[email protected]> Wed, 28 Jan 2026 05:10:35 +0000 (UTC)
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============5840353542329623213==
Content-Type: multipart/alternative;
boundary="----=_Part_4926954_901150350.1769577035491"
Content-Length: 2964
------=_Part_4926954_901150350.1769577035491
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Hello,
I recently tried to migrate logwatch's configuration that monitors service =
fail2ban from syslog files to systemd-journald. My configuration changes to=
ok effect, ie, logwatch-er now issues a "journalctl --unit=3Dfail2ban.servi=
ce --output=3Dcat" command to read the logs, however the log parser no long=
er matches anything and reports all the log lines as "unmatched entries".
Upon further inspection, it seems that syslog and systemd-journald outputs =
are not identical and thus incompatible with the parser. In particular, sys=
log prints the loglevel {DEBUG, INFO, WARNING, ...} on each log line, where=
as systemd-journald does not. The logwatcher parser anchors on these loglev=
el values to parse and extract the useful info from each line.=C2=A0
Arguebly, systemd-journald could print the loglevel (or priority as it is k=
nown for journalctl)... or the parser could make the loglevel value optiona=
l. Would it be feasible to update the regexps to ignore the loglevel ?
Thank you,Codin
------=_Part_4926954_901150350.1769577035491
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<html><head></head><body><div class=3D"yahoo-style-wrap" style=3D"font-fami=
ly:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div dir=
=3D"ltr" data-setdir=3D"false">Hello,</div><div dir=3D"ltr" data-setdir=3D"=
false"><br></div><div dir=3D"ltr" data-setdir=3D"false">I recently tried to=
migrate logwatch's configuration that monitors service fail2ban from syslo=
g files to systemd-journald. My configuration changes took effect, ie, logw=
atch-er now issues a "journalctl --unit=3Dfail2ban.service --output=3Dcat" =
command to read the logs, however the log parser no longer matches anything=
and reports all the log lines as "unmatched entries".</div><div dir=3D"ltr=
" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=3D"false">Up=
on further inspection, it seems that syslog and systemd-journald outputs ar=
e not identical and thus incompatible with the parser. In particular, syslo=
g prints the loglevel {DEBUG, INFO, WARNING, ...} on each log line, whereas=
systemd-journald does not. The logwatcher parser anchors on these loglevel=
values to parse and extract the useful info from each line. </div><di=
v dir=3D"ltr" data-setdir=3D"false"><br></div><div dir=3D"ltr" data-setdir=
=3D"false">Arguebly, systemd-journald could print the loglevel (or priority=
as it is known for journalctl)... or the parser could make the loglevel va=
lue optional. Would it be feasible to update the regexps to ignore the logl=
evel ?</div><div dir=3D"ltr" data-setdir=3D"false"><br></div><div dir=3D"lt=
r" data-setdir=3D"false">Thank you,</div><div dir=3D"ltr" data-setdir=3D"fa=
lse">Codin</div></div></body></html>
------=_Part_4926954_901150350.1769577035491--
--===============5840353542329623213==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============5840353542329623213==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel
--===============5840353542329623213==--