From 5f623596ee3d96d433458c3106e0f44cd7be04f6 Mon Sep 17 00:00:00 2001 From: alasdairdc Date: Tue, 17 Dec 2013 17:45:50 +0000 Subject: [PATCH 1/4] Updated check_fail2ban to return performance data for all jails Allows perf data from all jails to enable pnp4nagios to display a chart per jail when run with the command: check_fail2ban -p -w 1 -c 5 -P /usr/bin/fail2ban-client sample output: CHECK FAIL2BAN ACTIVITY - CRITICAL - 9 detected jails with 5 current banned IP(s) | apache-noscript.currentBannedIP=0 sendmail.currentBannedIP=0 postfix.currentBannedIP=0 ssh-probe.currentBannedIP=3 ssh-ddos.currentBannedIP=0 apache-multiport.currentBannedIP=0 apache.currentBannedIP=0 ssh.currentBannedIP=2 apache-overflows.currentBannedIP=0 --- files/nagios/check_fail2ban | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/files/nagios/check_fail2ban b/files/nagios/check_fail2ban index 77a63393..afde57d9 100755 --- a/files/nagios/check_fail2ban +++ b/files/nagios/check_fail2ban @@ -165,7 +165,7 @@ if (($critical < 0) or ($warning < 0) or ($critical < $warning)) { # Core script # ----------- -my ($how_many_jail,$how_many_banned,$return_print,$plugstate) = (0,0,"","OK"); +my ($how_many_jail,$how_many_banned,$return_print,$perf_print,$plugstate) = (0,0,"","","OK"); ### Test the connection to the fail2ban server @@ -214,6 +214,7 @@ else { else { print "DEBUG : the jail $jail_name has currently $current_ban_number banned IPs\n" if ($verbose_value); $how_many_banned += int($current_ban_number); + $perf_print .= "$jail_name.currentBannedIP=$current_ban_number " if ($perfdata_value); } } $return_print = $how_many_jail.' detected jails with '.$how_many_banned.' current banned IP(s)'; @@ -224,7 +225,7 @@ $plugstate = "CRITICAL" if ($how_many_banned >= $critical); $plugstate = "WARNING" if (($how_many_banned >= $warning) && ($how_many_banned < $critical)); $return_print = $display." - ".$plugstate." - ".$return_print; -$return_print .= " | currentBannedIP=$how_many_banned" if ($perfdata_value); +$return_print .= " | $perf_print" if ($perfdata_value); print $return_print; exit $ERRORS{"$plugstate"}; From 2e5a2b26fbd433a82016deae68dabd0d7a051c77 Mon Sep 17 00:00:00 2001 From: alasdairdc Date: Tue, 17 Dec 2013 17:48:19 +0000 Subject: [PATCH 2/4] Updated check_fail2ban to return performance data for all jails and applied to specific jail code --- files/nagios/check_fail2ban | 1 + 1 file changed, 1 insertion(+) diff --git a/files/nagios/check_fail2ban b/files/nagios/check_fail2ban index afde57d9..9bf14305 100755 --- a/files/nagios/check_fail2ban +++ b/files/nagios/check_fail2ban @@ -190,6 +190,7 @@ if ($jail_specific) { else { $how_many_banned = int($current_ban_number); $return_print = $how_many_banned.' current banned IP(s) for the specific jail '.$jail_specific; + $perf_print .= "$jail_name.currentBannedIP=$current_ban_number " if ($perfdata_value); } } ### To analyze all the jail From 4e4f194457c89253c75d5734eb185446129e489b Mon Sep 17 00:00:00 2001 From: alasdairdc Date: Wed, 18 Dec 2013 08:31:54 +0000 Subject: [PATCH 3/4] Updated Thanks. --- THANKS | 1 + 1 file changed, 1 insertion(+) diff --git a/THANKS b/THANKS index e448e09e..84f96b9a 100644 --- a/THANKS +++ b/THANKS @@ -10,6 +10,7 @@ Adam Tkac Adrien Clerc ache ag4ve (Shawn) +Alasdair D. Campbell Amir Caspi Andrey G. Grozin Andy Fragen From 04c267c307c670b17c0f7572a20a104d165d044e Mon Sep 17 00:00:00 2001 From: alasdairdc Date: Wed, 18 Dec 2013 08:36:30 +0000 Subject: [PATCH 4/4] Updated Changelog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 0eca4e37..77fd6a03 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,7 @@ ver. 0.8.12 (2013/12/XX) - things-can-only-get-better - remove indentation of name and loglevel while logging to SYSLOG to resolve syslog(-ng) parsing problems. Closes Debian bug #730202. - added squid filter. Thanks Roman Gelfand. + - updated check_fail2ban to return performance data for all jails. - New Features: