Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wishlist: Option to show the matching pattern in log files #2194

Open
jim-at-miramontes opened this issue Aug 6, 2018 · 2 comments
Open

Comments

@jim-at-miramontes
Copy link

I don't think this option currently exists: Add the matching pattern to log file results, maybe like so:

2018-07-08 03:13:57,822 fail2ban.actions [23459]: NOTICE [poison-attempts] Ban 1.1.1.1 [<HOST> .*GET \/wordpress]

I've recently had some problems with legit users getting blocked as a result of an overly-aggressive set of filters; knowing which filter they triggered would have been a big help.

@playaspec
Copy link

Seriously, why wasn't this is v.0.0.1?? It's IMPOSSIBLE to debug a filter that has multiple regex, on a jail that watches multiple log files. The log file tells us the 'what' (the filter) but not the WHY (the failregex).

I have 24 logfiles in a jail, and 16 regex in my filter watching Apache. Am I really supposed to make a jail and filter for every possible combination just so I can heave meaningful output in the logs?

@sebres
Copy link
Contributor

sebres commented Jun 11, 2019

I don't think this option currently exists: Add the matching pattern to log file results, maybe like so:
NOTICE [poison-attempts] Ban 1.1.1.1 [<HOST> .*GET \/wordpress]

The ban occurs after several failures (corresponding parameter maxretry), which could be matched consecutively by several regex's.
Either it should be written within Found message (then it is exactly one matching regex), or it could be a lot of regex's in this message.
Additionally to write a regex in log after each ban may be too heavy (a number would be enough).

It's IMPOSSIBLE to debug a filter that has multiple regex

Well it is possible, but at the moment only at level 7, which would produce too high log-output.

And it is pretty easy to DEBUG the filter with fail2ban-regex. You'll see each regex with number of log-lines matched. Or simply try it with the message only, to catch the regex:

fail2ban-regex "$msg" 'filter[mode=...]'

Seriously, why wasn't this is v.0.0.1??

Because nobody needs it?
The filter for usage in production should be also production ready (and then there is simply nothing to debug).

One needs a failregex in fail2ban log, another needs a log-file name there (see #2393), and I'm pretty sure we'll get more RFE's in this direction in the future.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants