All right in the
file /usr/share/logwatch/default.conf/services/fail2ban.conf change the
line:
LogFile = fail2ban to LogFile = messages
and in the file /usr/share/logwatch/default.conf/logfiles/fail2ban.conf
change the lines:
LogFile = fail2ban.log to LogFile = messages
Archive = fail2ban.log.1 to Archive = messages.*
then comment the other 2 Archive lines. If you are running rsyslog or
anything else that echos the journal into /var/log/messages this should
work for you.
Thanks for pointing out that it was not working
On Thu, 2015-10-08 at 12:59 +0100, Charles Bradshaw wrote:
> Hi All,
>
> I'm running a regularly updated version of CentOS and fail2ban as below.
>
> # cat /etc/redhat-release
> CentOS release 6.7 (Final)
>
> # fail2ban-server -V
> Fail2Ban v0.9.2
> ...
>
> Following a recent update I no longer see any fail2ban logwatch reports.
> I used to get daily summary reports of the number of bans for each jail.
>
> My logwatch detail is set to low and if I run from the command line:
> # logwatch --print --detail Low --service fail2ban --range today
> nothing reported.
>
> detail Medium and High produce similar verbose reports:
> # logwatch --print --detail Medium --service fail2ban --range today
>
> ################### Logwatch 7.3.6 (05/19/07) ####################
> Processing Initiated: Thu Oct 8 12:56:11 2015
> Date Range Processed: today
> ( 2015-Oct-08 )
> Period is day.
> Detail Level of Output: 5
> Type of Output: unformatted
> Logfiles for Host: dell2600-1.bradcan.homelinux.com
> ##################################################################
>
> --------------------- fail2ban-messages Begin ------------------------
>
> **Unmatched Entries**
> 2015-10-08 00:05:52,019 fail2ban.filter [3890]: INFO
> [forum-noregister] Found 219.132.8.150
> ... and lots more
>
>
> Obviously fail2ban is still running fine and I see root emails for those
> jails for which detail reports are enabled. Some of my jails result in
> hundreds of bans per day, these don't email and I would like to
> re-instate the logwatch reports.
>
> Does anybody know what changed, and perhaps more importantly, how to fix
> the reports?
>
> Thanks in advance.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Fail2ban-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
------------------------------------------------------------------------------
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
