2

Some messages in the fail2ban.log file are set to INFO, where I'd prefer them to be at DEBUG. I don't want some common detail in the logs. For example:

fail2ban.filter  [214912]: INFO [dovecot] Ignore 127.0.0.1 by ignoreself rule

Then there are messages that might be worth elevating from INFO to a level above, not quite WARNING, but more like FYI. Example:

[postfix] Found 1.2.3.4

Primary question: Where can we find information about how to manipulate the log level associated with a rule?

To be clear, I'm not asking about setting the logging level in /etc/fail2ban/fail2ban.local. That is a comparison value, and any log detail set at or above that value gets saved to the Fail2Ban log(s). I'm looking for the rule/filter value that the config value is compared to.

Related/secondary:

  • Where is the code that assigns the log level to specific rules?
  • Can we create more log levels?
  • I understand that "ignoreself" is built-in. Is it a legitimate change to lower ignoreself messages down to DEBUG-level logging?

Thanks.

1 Answer 1

1

** I have tried, and still couldn't do so. What I have tried was:**

First of all, from this website I see the different syntax of setting loglevel according to Fail2Ban version:

< 0.8.x : set log level using numeric only
0.9.x : set log level using string only
> 0.10 : Set log level with both numeric and string 

So, first I recommend you check your version, by:

# fail2ban-regex -V
0.11.2

This webpage bring a general explanation of setting loglevel for the full service.

I'm going to try to solve the same issue, by:

  1. Going to the relevant Fail2ban folder:
cd /etc/fail2ban/filter.d
  1. Then, access the specific FILTER (i.e., 'rule'), which you would like to set a specific loglevel for via a text editor:
vi jail_name_exampple.conf
  1. Add the following under the JAIL's already set header '[Definition]' configuration file VERY end:
[Definition]
..
..
..
loglevel = DEBUG

Note:

A) Manually configured Jail-Filter may use under score "_" in the file name, however possibly would fail if using a dash "-"

B) The various 'loglevel' levels are: CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG, TRACEDEBUG, HEAVYDEBUG where to the best of my understanding DEBUG is the more severe.

C) I have seen a recommendation to make sure that your loglevel specified in fail2ban.conf/.local is not at DEBUG level -- which might then cause fail2ban to fall into an infinite loop constantly feeding itself with non-informative lines HOWEVER I was checking DEBUG for a JAIL for a short time

  1. Restart the service, possibly by:
sudo service fail2ban restart

Or

sudo systemctl restart fail2ban
  1. Checked loglevel per Jail and still saw the general configuration:
fail2ban-client get loglevel jail_name_exampple
Current logging level is 'INFO'

3
  • Hey, thanks for your contribution, and welcome to ServerFault! I haven't looked at this issue since writing the OP but I do still want to get a solid handle on the topic. I will read your linked resources and get back here as possible - honestly it might take up to a couple months given current priorities.
    – TonyG
    May 16, 2023 at 22:56
  • @TonyG remind to accept the answer, if it solved your issue else we will hunted and remembered for ever
    – djdomi
    May 28, 2023 at 14:47
  • @djdomi No reminder necessary. Less than two weeks ago I said it might take up to a couple months to evaluate this helpful response to an old inquiry. Nothing has changed. I'll be back when I can.
    – TonyG
    May 29, 2023 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .