Hi,
You should duplicate the logpath setting as a parameter to the
sendmail-whois-lines. The default setting for the logpath in
sendmail-whois-lines is /dev/null.
Try:
action = iptables-multiport[name=apache-noscanners,port="80,443"]
sendmail-whois-lines[name=apache-noscanners,
[email protected], [email protected], sendername="Fail2Ban",
logpath=/var/log/httpd/*access_log]
Regards,
Tom
On 02-11-15 17:27, Bond Masuda wrote:
> On 11/02/2015 07:50 AM, Tom Hendrikx wrote:
>> Hi,
>>
>> Please show jail config for the related apache jail.
>>
> [apache-noscanners]
> enabled = true
> port = http,https
> filter = apache-noscanners
> action = iptables-multiport[name=apache-noscanners,port="80,443"]
> sendmail-whois-lines[name=apache-noscanners,
> [email protected], [email protected], sendername="Fail2Ban"]
> logpath = /var/log/httpd/*access_log
> maxretry = 2
> bantime = 172800
>
>>
>> On 02-11-15 16:09, Bond Masuda wrote:
>>> I'm using the sendmail-whois-lines action (default, not modified) in
>>> hopes of seeing some of the log entries associated to a ban. But I get
>>> this in the email:
>>>
>>> Lines containing IP:5.178.68.237 in /dev/null
>>>
>>>
>>> Surely, the log it is monitoring was not /dev/null. It was suppose to be
>>> /var/log/httpd/*access_log. Am I doing something wrong here?
>>> thx
>>>
>>> ------------------------------------------------------------------------------
>>> _______________________________________________
>>> Fail2ban-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> Fail2ban-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Fail2ban-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
------------------------------------------------------------------------------
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
