Fail2Ban log

Discussion in 'Installation/Configuration' started by pecka33, Apr 16, 2020.

  1. pecka33

    pecka33 Member

    Hello,

    i have a question.

    when i look at my ispconfig fail2ban log, i can see there records as. I am not sure what does mean number before line + and number?

    +66414 7F970BFFF700 fail2ban.filter INFO [sasl] Found 185.50.149.5 - 2020-04-16 13:26:22
    +66418 7F97296C5700 fail2ban.filter INFO [postfix-aggressive] Found 185.50.149.5 - 2020-04-16 13:26:05
    +66419 7F97296C5700 fail2ban.filter INFO [postfix-aggressive] Found 185.50.149.5 - 2020-04-16 13:26:05
    +66420 7F97296C5700 fail2ban.filter INFO [postfix-aggressive] Found 185.50.149.5 - 2020-04-16 13:26:10
    +66420 7F97296C5700 fail2ban.filter INFO [postfix-aggressive] Found 185.50.149.5 - 2020-04-16 13:26:16
    +66421 7F97296C5700 fail2ban.filter INFO [postfix-aggressive] Found 185.50.149.5 - 2020-04-16 13:26:22
    +66421 7F97296C5700 fail2ban.filter INFO [postfix-aggressive] Found 185.50.149.5 - 2020-04-16 13:26:23
    +66808 7F9728EC4700 fail2ban.actions NOTIC [postfix-aggressive] Ban 185.50.149.5
    +92112 7F972C720700 fail2ban.filter INFO [sshd] Found 180.109.33.220 - 2020-04-16 13:28:22
    +92113 7F972C720700 fail2ban.filter INFO [sshd] Found 180.109.33.220 - 2020-04-16 13:28:22
    +93718 7F972C720700 fail2ban.filter INFO [sshd] Found 180.109.33.220 - 2020-04-16 13:28:24
    +160140 7F972C720700 fail2ban.filter INFO [sshd] Found 111.229.160.11 - 2020-04-16 13:29:30
    +160144 7F972C720700 fail2ban.filter INFO [sshd] Found 111.229.160.11 - 2020-04-16 13:29:30
    +161980 7F972C720700 fail2ban.filter INFO [sshd] Found 111.229.160.11 - 2020-04-16 13:29:32
     
    pecka33, Apr 16, 2020
    #1
  2. pecka33

    pecka33 Member

    Now looks fine, just a see there one message i never seen before

    ERROR No failure-id group in '(?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P\S*),.*'
    2020-04-16 13:35:12,074 fail2ban.transmitter [670]: WARNING Command ['set', 'dovecot-pop3imap', 'addfailregex', '(?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \\(auth failed|Aborted login \\(tried to use disabled|Disconnected \\(auth failed|Aborted login \\(\\d+ authentication attempts).*rip=(?P\\S*),.*'] has failed. Received RegexException("No failure-id group in '(?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \\(auth failed|Aborted login \\(tried to use disabled|Disconnected \\(auth failed|Aborted login \\(\\d+ authentication attempts).*rip=(?P\\S*),.*'")
    2020-04-16 13:35:12,075 fail2ban [670]: ERROR NOK: ("No failure-id group in '(?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \\(auth failed|Aborted login \\(tried to use disabled|Disconnected \\(auth failed|Aborted login \\(\\d+ authentication attempts).*rip=(?P\\S*),.*'",)
    2
     
    pecka33, Apr 16, 2020
    #2
  3. pecka33

    pecka33 Member

    Probably solved. I can not see any other errors right now.
     
    pecka33, Apr 16, 2020
    #3

Share This Page