Posts by fulltilt

    received a strange message this morn ... possibly a security problem?
    the only plugin installed on this server is the spamassassin-plugin

    @fulltilt


    Try to force the logs rotation before restarting fail2ban. If the problem gone, this mean that your logfiles were too big. Failban can take a lot of time to parse the log files.


    Shell-Script
    1. # logrotate -f /etc/logrotate.d/apache2# service fail2ban restart


    Also, try to lower the value for the findtime parameter to 120. If you have many logs, fail2ban (with the findtime parameter set to 3600 seconds), will parse each of them for the last hour... This can take a lot of time and give you the impression that the daemon hangs.


    thank you, but no luck
    it hangs again, very strange ... after that I always have to kill the F2B processes, because I'm not able to stop F2B
    it works for all other logfiles also with access.logs but no longer with error.logs

    Code
    1. working:
    2. [wordpress]
    3. enabled = true
    4. port = http,https
    5. filter = wordpress-auth
    6. logpath = /var/log/apache2/*/access.log
    7. maxretry = 6


    do you think it could be a permission problem?

    with a single error log, it works:

    Code
    1. logpath = /var/log/apache2/admin.host3.domain.tld/error.log


    but not with the * inside the path:

    Code
    1. logpath = /var/log/apache2/*/error.log


    I guess it's not a problem with the file sizes

    Code
    1. du -sh /var/log/apache2
    2. 384M /var/log/apache2


    or to many files open ... I dont know but before the kernel update I never had such a problem
    also checked the system logs ... but nothing showed anything wrong with fail2ban or apache ...

    and all the logs with "started" are missing

    Code
    1. 2014-07-01 10:09:00,381 fail2ban.jail : INFO Jail 'ssh' started
    2. 2014-07-01 10:09:00,391 fail2ban.jail : INFO Jail 'roundcube' started
    3. 2014-07-01 10:09:00,409 fail2ban.jail : INFO Jail 'apache-badbots' started
    4. 2014-07-01 10:09:00,423 fail2ban.jail : INFO Jail 'wordpress' started
    5. 2014-07-01 10:09:00,435 fail2ban.jail : INFO Jail 'imscp' started
    6. 2014-07-01 10:09:00,445 fail2ban.jail : INFO Jail 'imscp-multiport' started
    7. 2014-07-01 10:09:00,452 fail2ban.jail : INFO Jail 'imscp-noscript' started
    8. 2014-07-01 10:09:00,468 fail2ban.jail : INFO Jail 'imscp-overflows' started
    9. 2014-07-01 10:09:00,483 fail2ban.jail : INFO Jail 'proftpd' started


    something is wrong with the logfiles ... but how can this be fixed?