From 8b62353ab06369023f8e71bdc1d3228ad1f988f6 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Wed, 13 Aug 2014 23:24:38 -0400 Subject: [PATCH] BF: logwatch -- fixing up regex for 'already banned' --- 3rdparty/logwatch/fail2ban | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/3rdparty/logwatch/fail2ban b/3rdparty/logwatch/fail2ban index 46dd11b5..117c7521 100755 --- a/3rdparty/logwatch/fail2ban +++ b/3rdparty/logwatch/fail2ban @@ -108,11 +108,14 @@ while (defined(my $ThisLine = )) { } push @{$ServicesBans{$Service}{$Host}{'Failures'}}, $NumFailures; } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ \S+:\s(.*):\s(\S+)\salready in ban list/)) { - $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; - } elsif ( my ($Service,$Host) = ($ThisLine =~ m/\S+\s*\[(.*)\]\s*(\S+)\s*already banned/)) { - $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; + $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; + } elsif ( my ($Service,$Host) = ($ThisLine =~ m/\S+:?\s+\[?([^[]*?)[]:]?\s+(\S+)\salready banned/)) { + if ( $Debug >= 6 ) { + print STDERR "DEBUG($DebugCounter): Found hit for already banned $Host against $Service\n"; + } + $ServicesBans{$Service}{$Host}{'AlreadyInTheList'}++; } elsif ( my ($Service,$Host) = ($ThisLine =~ m/ \S+:\s(.*):\sReBan (\S+)/)) { - $ServicesBans{$Service}{$Host}{'ReBan'}++; + $ServicesBans{$Service}{$Host}{'ReBan'}++; } elsif ($ThisLine =~ / ERROR:?\s*(Execution of command )?\'?iptables/) { push @ActionsErrors, "$ThisLine\n"; } elsif ($ThisLine =~ / ERROR\s*Failed to execute.*action/) {