I'm getting a large number of sql injection attempts that all look alike on a daily basis. A snippet from the access logs shows:

8222 - - [09/Nov/2018:08:47:25 -0600] ***************.com "GET /Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912 HTTP/1.1" 302 0 "https://www.***************.com/Add_Product.php?strPhotoID=VA1209&price_selected=2+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526--&page_id=912" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" "-"

This is the configuration in jail.local:

enabled = true
filter = sql-union-select-attack
logpath = /var/log/nginx/*access.log
port = 8221,8222,8231,8232
maxretry = 1
findtime = 10
bantime = -1
action = iptables-allports[name=sqlUnionSelect]

Here is the filter (sql-union-select-attack.conf):

#The SQL Injection attempt with "union+select+" in the URL
failregex = ^\d{4} <HOST> -.*\"(GET|POST).*/Add_Product.php.*union

Yet here I am, getting no bans as shown with

fail2ban-client status sql-union-select-attack

    root@web4:/etc/fail2ban# fail2ban-client status sql-union-select-attack
    Status for the jail: sql-union-select-attack
    |- Filter
    |  |- Currently failed: 0
    |  |- Total failed: 0
    |  `- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
    `- Actions
       |- Currently banned: 0
       |- Total banned: 0
       `- Banned IP list:   

What is going on here? Is something incorrect with my jail.local configuration?


Thanks to Michael Hampton's answer, it appears to be working now. I have a bash script that lets me select a jail to get the status:

root@web4:/etc/fail2ban# get_jail_status 
Please enter the jail you would like to check: 
Status for the jail: sql-union-select-attack
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 2
|  `- File list:    /var/log/nginx/**************.access.log /var/log/nginx/access.log
`- Actions
   |- Currently banned: 5
   |- Total banned: 5
   `- Banned IP list:

If I select one of those IP addresses and check it in iptables, it appears:

root@web4:/etc/fail2ban# iptables -L -v -n | grep
0     0 REJECT     all  --  *      *            reject-with icmp-port-unreachable

So it appears to be working!

  • Check your jail.conf and see what the default backend is set to? Nov 9, 2018 at 15:24
  • It is set to backend = auto Nov 9, 2018 at 15:34
  • Make sure you have pyinotify installed, then, or reinstall it, e.g.: sudo apt-get install --reinstall python-pyinotify Nov 9, 2018 at 15:35
  • It was not installed. Just installed it. Should I restart the fail2ban-client? Nov 9, 2018 at 15:36
  • Yes, you'll need to restart fail2ban. It can't read log files (other than the systemd journal) without pyinotify. Nov 9, 2018 at 15:40

1 Answer 1


Fail2ban needs to have pyinotify installed to read log files other than via the systemd journal. If it isn't installed, then you should install or reinstall it. For example:

sudo apt-get install python-pyinotify

After that, restart fail2ban and wait a few minutes for it to chew through the existing log files.

(Technically it can also use gamin, but historically that hasn't been very reliable...)

  • Edited my question to show that your answer worked. Thank you! Nov 9, 2018 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.