From d34d8db3d2bf361853cf7f9fa8b2cd3ca0edc707 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 22 Nov 2013 15:57:03 -0500 Subject: [PATCH 1/4] BF/ENH: include [PID] into logging msgs, remove indentation from syslog messages Otherwise leads to incorrect parsing of the log messages by syslog(-ng). See http://bugs.debian.org/730202 I also removed %(levelname)-6s from syslog messages completely since they are passed to the syslog and it is up to the configuration/admin to decide include levels into the messages or not (I have checked that at least debug level indeed goes to /var/log/debug) --- server/server.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/server/server.py b/server/server.py index 773fdf0b..44d8ae68 100644 --- a/server/server.py +++ b/server/server.py @@ -347,13 +347,12 @@ class Server: try: self.__loggingLock.acquire() # set a format which is simpler for console use - formatter = logging.Formatter("%(asctime)s %(name)-16s: %(levelname)-6s %(message)s") + formatter = logging.Formatter("%(name)s[%(process)d]: %(levelname)-7s %(message)s") if target == "SYSLOG": # Syslog daemons already add date to the message. - formatter = logging.Formatter("%(name)-16s: %(levelname)-6s %(message)s") + formatter = logging.Formatter("%(name)s[%(process)d]: %(message)s") facility = logging.handlers.SysLogHandler.LOG_DAEMON - hdlr = logging.handlers.SysLogHandler("/dev/log", - facility = facility) + hdlr = logging.handlers.SysLogHandler("/dev/log", facility=facility) elif target == "STDOUT": hdlr = logging.StreamHandler(sys.stdout) elif target == "STDERR": From a6f085786ca46485557c0adbe6b6510f1a06253b Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 24 Nov 2013 09:50:39 -0500 Subject: [PATCH 2/4] ENH: reintroducing levelnameinto syslog msgs, time stamp and indentation in non-syslog msgs any indentation from syslog msgs wsa removed -- no need --- server/server.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/server/server.py b/server/server.py index 44d8ae68..6ac93a54 100644 --- a/server/server.py +++ b/server/server.py @@ -347,10 +347,10 @@ class Server: try: self.__loggingLock.acquire() # set a format which is simpler for console use - formatter = logging.Formatter("%(name)s[%(process)d]: %(levelname)-7s %(message)s") + formatter = logging.Formatter("%(asctime)s %(name)-16s[%(process)d]: %(levelname)-7s %(message)s") if target == "SYSLOG": # Syslog daemons already add date to the message. - formatter = logging.Formatter("%(name)s[%(process)d]: %(message)s") + formatter = logging.Formatter("%(name)s[%(process)d]: %(levelname)s %(message)s") facility = logging.handlers.SysLogHandler.LOG_DAEMON hdlr = logging.handlers.SysLogHandler("/dev/log", facility=facility) elif target == "STDOUT": From a26d4f42b7b4b3a7359e64eba4d5997eef25db46 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 24 Nov 2013 09:59:45 -0500 Subject: [PATCH 3/4] ENH: added optional [PID] matching in recidive.conf --- config/filter.d/recidive.conf | 2 +- testcases/files/logs/recidive | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf index b29acaf3..13d2f53a 100644 --- a/config/filter.d/recidive.conf +++ b/config/filter.d/recidive.conf @@ -27,6 +27,6 @@ _daemon = fail2ban\.actions # jail using this filter 'recidive', or change this line! _jailname = recidive -failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ +failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions%(__pid_re)s?:\s+)WARNING\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ # Author: Tom Hendrikx, modifications by Amir Caspi diff --git a/testcases/files/logs/recidive b/testcases/files/logs/recidive index 6af85137..83acc3e1 100644 --- a/testcases/files/logs/recidive +++ b/testcases/files/logs/recidive @@ -1,5 +1,7 @@ # failJSON: { "time": "2006-02-13T15:52:30", "match": true , "host": "1.2.3.4" } 2006-02-13 15:52:30,388 fail2ban.actions: WARNING [sendmail] Ban 1.2.3.4 +# failJSON: { "time": "2006-02-13T15:52:30", "match": true , "host": "1.2.3.4", "desc": "Extended with [PID]" } +2006-02-13 15:52:30,388 fail2ban.actions[123]: WARNING [sendmail] Ban 1.2.3.4 # failJSON: { "match": false } 2006-02-13 16:07:31,183 fail2ban.actions: WARNING [sendmail] Unban 1.2.3.4 # failJSON: { "match": false } From 085ebbe1de7477733b28e06204ccbb19ea2c3d09 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Sun, 24 Nov 2013 11:55:58 -0500 Subject: [PATCH 4/4] Changelog entries for the last changes --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 24f01e9a..a26257f1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,8 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - Fixes: - allow for ",milliseconds" in the custom date format of proftpd.log - allow for ", referer ..." in apache-* filter for apache error logs. + - remove indentation of name and loglevel while logging to SYSLOG to + resolve syslog(-ng) parsing problems. Closes Debian bug #730202. - New Features: @@ -22,6 +24,7 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better * filter.d/solid-pop3d -- added thanks to Jacques Lav!gnotte on mailinglist. - Enhancements: + - loglines now also report "[PID]" after the name portion ver. 0.8.11 (2013/11/13) - loves-unittests-and-tight-DoS-free-filter-regexes