Fail2ban is installed on one of the servers, I'm able to ban every IP that try to log in.

I'm using the check_log plugin of Nagios to capture the last line of the fail2ban.log, it compares to the fail2ban.log.old and report the Warning state when detects the word "ban".

It works, thing is I can't let it do one check only and reset to OK state after. It keeps sending me email (and showing me warning) about the same banned IP, (which now is not banned anymore).

I created on Nagios server a service called log-service just for this, where

passive_checks_enabled 0
is_volatile 1
max_check_attempts 1
retry_check_interval 2

It does check the service every 2 minutes, but it's always reporting a warning state (and I collected 19 emails for now).

Can somebody tell me what is wrong? Or a better method if mine is not the best? I don't think there is need to post any log but if you ask I'll just post it.

EDIT: The service definition (re-Edited)

define service{
        name                            log-service
        active_checks_enabled           1       ; Active service checks are enabled
        passive_checks_enabled          0       ; Passive service checks are enabled/accepted
        parallelize_check               1       ; Active service checks should be parallelized (disabling this can lead to major performance problems)
        obsess_over_service             1       ; We should obsess over this service (if necessary)
        check_freshness                 0       ; Default is to NOT check service 'freshness'
        notifications_enabled           1       ; Service notifications are enabled
        event_handler_enabled           1       ; Service event handler is enabled
        flap_detection_enabled          0       ; Flap detection is enabled
        process_perf_data               1       ; Process performance data
        retain_status_information       1       ; Retain status information across program restarts
        retain_nonstatus_information    1       ; Retain non-status information across program restarts
        is_volatile                     1       ; The service is not volatile
        check_period                    24x7    ; The service can be checked at any time of the day
        max_check_attempts              1       ; Re-check the service up to 1 time in order to determine its final (hard) state
        check_interval           2      ; Check the service every 2 minutes under normal conditions
        retry_interval            2     ; Re-check the service every two minutes until a hard state can be determined
        contact_groups                  admins  ; Notifications get sent out to everyone in the 'admins' group
        notification_options            w,u,c,r ; Send notifications about warning, unknown, critical, and recovery events
        notification_interval           0       ; Re-notify about service problems every hour
        notification_period             24x7    ; Notifications can be sent out at any time
        register                        0
  • "retry_check_interval" is Nagios 2.x syntax, fwiw
    – Keith
    Jan 29 '16 at 15:57
  • can you add your full service definition to the question?
    – Keith
    Jan 29 '16 at 16:03
  • sorry the late I wasn't online last week, yes I'm updating it. templates.cfg uses "retry_check_interval" so I just left like this in my definition
    – aPugLife
    Feb 8 '16 at 8:49
  • Ok I soved, I only needed a week of rest. Actually there's nothing wrong in my definition, only flap_detection set to 0 and updatedretry_check_interval and normal to the newest nagios 4
    – aPugLife
    Feb 8 '16 at 12:13
  • ah yeah, I forgot to say that it doesn't automatically return to OK but if in the next check will not find any new row from the log file then it goes OK. This, every 2 minutes.
    – aPugLife
    Feb 8 '16 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.