Fail2ban doesn't send lines from logs

[dronnikovigor]

After upgrading to omv 7 from 6.5 several month ago I noticed, that fail2ban emails don't contains lines from logs anymore.

I have only message of whois followed by phrase:

...
origin:         AS9009
mnt-by:         GLOBALAXS-MNT
created:        2021-05-14T09:47:51Z
last-modified:  2021-05-14T09:47:51Z
source:         RIPE
% This query was served by the RIPE Database Query Service version 1.113.2 (SHETLAND)
Lines containing failures of X.X.X.X (max 1000)
Regards,
Fail2Ban

I tried to reinstall fail2ban plugin with cleaning /etc/fail2ban folder, system is up to date.

Action used is action_mwl. I also tried some kind of debugging and put printf after "Lines...". And it outputs just /dev/null.

Finally, I managed to localize problem by myself.

In commits of this plugin I found this commit https://github.com/OpenMediaVa…961934b8db938f1fc8cc08L22

That removes logpath from action's parameters.

I created jail.local and restarted fail2ban. Now everything work.

[DEFAULT]

action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

So, i wonder, if it's a bug and should be fixed.

[alexshalex]

Тell me if the solution will be presented in the plugin or if you need to do it manually. Thanks

[ryecoaaron]

I will not be adding it to the plugin. With the logpath part in there, it breaks fail2ban for some jails. Without the logpath, some jails don't send logging. I prefer the latter. If someone can come up with a solution that works for both, I will add it.

[mckaygerhard]

it breaks fail2ban for some jails. Without the logpath, some jails don't send logging.

nonsense the "it breaks some jails" .. OMV is Debian only so paths are well know OMV plugins MAY assume all the services comes from packages.. not form 3rth party providers so paths are well know and sure to be into, any 3rth party providers must know what is doing.. so if not just use package offical ones!

ALSO: but! as i know.. default jails from debian (SSH) already has /etc/fail2ban/paths-debian.conf .. for custom paths you @ryecoaaron SHOULD implement any path from /etc/fail2ban/paths-overrides.conf

this behaviour of non paths also causes that default examples of jails provided with the package being poorly effective.. and now i understand why are unusefully in some way

[ryecoaaron]

nonsense the "it breaks some jails" .. OMV is Debian only so paths are well know OMV plugins MAY assume all the services comes from packages.. not form 3rth party providers so paths are well know and sure to be into, any 3rth party providers must know what is doing.. so if not just use package offical ones!

Nonsense? Specifying a log path for a plugin sending logs to systemd DOES break the plugin. It has nothing to do with the actual path of the log file.

Since you know what the problem is, fix the plugin. As I have said time and time and time again, I do not use all plugins including this one. If people want it to work correctly, they will have to contribute. I am only maintaining the web interface part of the plugin.

[mckaygerhard]

ok i will try to my best based on your directions.. let me try what can i do respect the paths, wheantime work in the other issue let me try to work on both but could you check it issue #38 ? and give me your opinion..

[mckaygerhard]

ok confirmed what you said @ryecoaaron the removal of logpath is becouse shistemd so makes sense BUT so i guess this is a valid bug cos there is no logs anymore in the mails, logs must be extracted from shistemd and then parse to the mail body.. is a complicated procedure right now as i can check respect of the previous behavior

In commits of this plugin I found this commit https://github.com/OpenMediaVa…961934b8db938f1fc8cc08L22

@dronnikovigor the change you made is not a full solution but need a second change.. to work you must also fix the removal of logs files since OMV 7.X .. in your setup it works cos your syslog/rsyslog was inhered from older system and logs are presents.. but in clean install of omv most of those files or logs are empty or missing because of openmediavault/openmediavault#1909 (comment) so you must enable rsyslog as i commented to your change works, so the solution proposed by @dronnikovigor only works if rsyslog are fully enabled.. to make it wok again first reenable the rsyslog by uncommenting the lines and later reverting the lines of the commit pointed by you is the compelte workaround

so fasil2ban plugins does not send offending lines from logs in mail as confiurme here openmediavault/openmediavault#1909 (comment) and here openmediavault/openmediavault#1909 (comment) that is not easy to do. .. rsyslog rulez then by now.