diff --git a/ChangeLog b/ChangeLog index de462a71..f03b2b13 100644 --- a/ChangeLog +++ b/ChangeLog @@ -35,6 +35,8 @@ ver. 0.10.5-dev-1 (20??/??/??) - development edition ----------- ### Fixes +* [compatibility] systemd backend: default flags changed to SYSTEM_ONLY(4), fixed in gh-2444 in order to ignore + user session files per default, so could prevent "Too many open files" errors on a lot of user sessions (see gh-2392) * [grave] fixed parsing of multi-line filters (`maxlines` > 1) together with systemd backend, now systemd-filter replaces newlines in message from systemd journal with `\n` (otherwise multi-line parsing may be broken, because removal of matched string from multi-line buffer window diff --git a/fail2ban/server/filtersystemd.py b/fail2ban/server/filtersystemd.py index 5f17596a..be5a6dc4 100644 --- a/fail2ban/server/filtersystemd.py +++ b/fail2ban/server/filtersystemd.py @@ -86,10 +86,12 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover files.extend(glob.glob(p)) args['files'] = list(set(files)) + # Default flags is SYSTEM_ONLY(4). This would lead to ignore user session files, + # so can prevent "Too many open files" errors on a lot of user sessions (see gh-2392): try: args['flags'] = int(kwargs.pop('journalflags')) except KeyError: - pass + args['flags'] = 4 return args