search for: _systemd_unit

Anything interesting in the logs? sudo journalctl -xf _SYSTEMD_UNIT=crond.service

...reated a my-f2bfsshd.pp & my-f2bfsshd.te 3. restarted fail2ban via systemctl restart fail2ban.service 4. monitored via fail2ban-client status <filter_name> and now get Status for the jail: sshd |- Filter |? |- Currently failed:??? 0 |? |- Total failed:??? 109 |? `- Journal matches:??? _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions ?? |- Currently banned:??? 3 ?? |- Total banned:??? 6 ?? `- Banned IP list:??? 27.78.14.83 116.105.216.179 139.99.71.227 5. set fail2ban back into enforcing with semanage permissive -d fail2ban_t All solved for me. I have now done this on a second machine...

On Fri, May 22, 2020 2:05 pm, Adi Pircalabu wrote: > On 22-05-2020 10:38, Voytek Eymont wrote: > > Hardly a Dovecot issue. Can you please post the output of this command? > /usr/bin/fail2ban-regex /var/log/dovecot.log > /etc/fail2ban/filter.d/dovecot.conf Adi, thanks, what I get is: # /usr/bin/fail2ban-regex /var/log/dovecot.log /etc/fail2ban/filter.d/dovecot.conf Running

On Saturday 23 of April 2016 10:08:54 AM Kahlil Hodgson wrote: > Anything interesting in the logs? > > sudo journalctl -xf _SYSTEMD_UNIT=crond.service Don't know. [root at kohrin cron.d]# sudo journalctl -xf _SYSTEMD_UNIT=crond.service -- Logs begin at ?ro 2015-12-02 22:34:16 CET. -- kwi 22 23:11:01 vz471 crond[30534]: (*system*) RELOAD (/etc/cron.d/osticket-cron) kwi 22 23:13:01 vz471 crond[30534]: (*system*) RELOAD (/etc/c...

On 23 April 2016 at 10:25, Marcin Trendota <moonwolf.rh at gmail.com> wrote: > Anything interesting in the logs? > > > > sudo journalctl -xf _SYSTEMD_UNIT=crond.service > > Don't know. > > [root at kohrin cron.d]# sudo journalctl -xf _SYSTEMD_UNIT=crond.service > ?...? > (/etc/cron.d/osticket-cron) > kwi 22 23:28:01 vz471 crond[30534]: (*system*) RELOAD > (/etc/cron.d/osticket-cron) > kwi 22 23:30:01 vz471 crond[30534...

On Tue, Oct 13, 2015 at 1:58 PM, Richard <lists-centos at listmail.innovate.net> wrote: > > >> Date: Tuesday, October 13, 2015 13:54:28 +0000 >> From: "C. L. Martinez" <carlopmart at gmail.com> >> >> On Tue, Oct 13, 2015 at 1:45 PM, Richard >> <lists-centos at listmail.innovate.net> wrote: >>> >>>> Date: Tuesday,

...? cat jail.local ... [dovecot] enabled = true filter = dovecot logpath = /var/log/dovecot.log maxretry = 3 ignoreip = 127.0.0.1 127.0.0.0/8 ... # fail2ban-client status dovecot Status for the jail: dovecot |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=dovecot.service `- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list: # grep 'auth failed' /var/log/dovecot.log | wc 7669 149916 1558909 # cat dovecot.conf # Fail2Ban filter Dovecot authentication and pop3/imap server # [INCLUDES] before = common.conf...

...e; enabled) >> Active: active (running) since Tue 2015-10-13 05:33:28 UTC; 8h ago >> Main PID: 607 (crond) >> CGroup: /system.slice/crond.service >> ??607 /usr/sbin/crond -n > > Do you see anything helpful in the journal? > > run 'journalctl _SYSTEMD_UNIT=crond.service' > Nop, because binary logs (using journalctl) are disabled in this host ... But under /var/log/messages, there is no error ...

...2ban-client set dovecot banip $F done which worked. However, having done this, the connections are still getting through to EXIM. [root at ollie2 ~]# fail2ban-client status dovecot Status for the jail: dovecot |- Filter | |- Currently failed: 6 | |- Total failed: 199 | `- Journal matches: _SYSTEMD_UNIT=dovecot.service `- Actions |- Currently banned: 41 |- Total banned: 82 `- Banned IP list: 46.232.112.21 106.226.231.159 113.120.142.149 113.120.143.41 114.106.134.228 114.238.30.180 116.91.166.50 117.24.39.199 117.29.90.228 117.31.46.4 117.60.247.84 119.127.17.82 120.43.54.45 121.233...

Am 08.10.2013 14:46, schrieb Stefan G. Weichinger: >> Try enabling the flag, re-emerging the package, setting the logs and >> then reproduce it again. Check the logs and you should see why it's >> disconnecting. The docs say that libvirtd has to listen on the TCP port ... checked that: # netstat -alnp | grep libv tcp 0 0 0.0.0.0:16509 0.0.0.0:*

...sr/lib/systemd/system/crond.service; enabled) > Active: active (running) since Tue 2015-10-13 05:33:28 UTC; 8h ago > Main PID: 607 (crond) > CGroup: /system.slice/crond.service > ??607 /usr/sbin/crond -n Do you see anything helpful in the journal? run 'journalctl _SYSTEMD_UNIT=crond.service' -- Jonathan Billings <billings at negate.org>

...> 3. restarted fail2ban via systemctl restart fail2ban.service > > 4. monitored via fail2ban-client status <filter_name> and now get > > Status for the jail: sshd > |- Filter > |? |- Currently failed:??? 0 > |? |- Total failed:??? 109 > |? `- Journal matches:??? _SYSTEMD_UNIT=sshd.service + _COMM=sshd > `- Actions > ?? |- Currently banned:??? 3 > ?? |- Total banned:??? 6 > ?? `- Banned IP list:??? 27.78.14.83 116.105.216.179 139.99.71.227 > > 5. set fail2ban back into enforcing with > > semanage permissive -d fail2ban_t > > All solved...

..., you're getting some matches there, although you might want to revisit it it the result is not consistent with your own searches. It might be that Dovecot isn't logging to systemd' journal, or the regex doesn't match the journal entries. Try to comment out "journalmatch = _SYSTEMD_UNIT=dovecot.service" entry in your filter file, restart f2b and see if there's any change. P.S. Let's try and keep the replies to the list :) -- Adi Pircalabu

Why bother with */1? Wouldn't that be the same as just *? On Apr 22, 2016 5:48 PM, "Marcin Trendota" <moonwolf.rh at gmail.com> wrote: > On Friday 22 of April 2016 11:40:33 PM Marcin Trendota wrote: > > What the heck is wrong with cron? > > > > */1 * * * * nobody /usr/bin/php /var/www/html/osticket/api/cron.php > > > > in /etc/cron.d

In https://wiki.dovecot.org/HowTo/Fail2Ban, for a current (I know for a fact in 2.2.36) I believe it should be filter = dovecot instead of filter = dovecot-pop3imap [root at mail ~]# ls -l /etc/fail2ban/filter.d/doveco* -rw-r--r-- 1 root root 1875 May 11 2017 /etc/fail2ban/filter.d/dovecot.conf [root at mail ~]#

Hi! Am 09.04.20 um 10:07 schrieb Rob Kampen: [...] > I too had fail2ban fail after an otherwise successful yum update. Mine occurred in Feb when my versions of firewalld etc were updated to the versions you show. Thus far I have not had the opportunity to sort the problem. Lockdown has been quite busy so far, hopefully some slower times coming next week. Yeah, those pesky real-life biological

...); + ('f', "_CMDLINE"); + ('g', "_CAP_EFFECTIVE"); + ('h', "_AUDIT_SESSION"); + ('i', "_AUDIT_LOGINUID"); + ('j', "_SYSTEMD_CGROUP"); + ('k', "_SYSTEMD_SESSION"); + ('l', "_SYSTEMD_UNIT"); + ('m', "_SYSTEMD_USER_UNIT"); + ('n', "_SYSTEMD_OWNER_UID"); + ('o', "_SYSTEMD_SLICE"); + ('p', "_SELINUX_CONTEXT"); + ('q', "_SOURCE_REALTIME_TIMESTAMP"); + ('r', "_BOOT_ID");...

...then, you're getting some matches there, although you might want to revisit it it the result is not consistent with your own searches. It might be that Dovecot isn't logging to systemd' journal, or the regex doesn't match the journal entries. Try to comment out "journalmatch = _SYSTEMD_UNIT=dovecot.service" entry in your filter file, restart f2b and see if there's any change. P.S. Let's try and keep the replies to the list :) -- Adi Pircalabu

..., + "f", "_CMDLINE", + "g", "_CAP_EFFECTIVE", + "h", "_AUDIT_SESSION", + "i", "_AUDIT_LOGINUID", + "j", "_SYSTEMD_CGROUP", + "k", "_SYSTEMD_SESSION", + "l", "_SYSTEMD_UNIT", + "m", "_SYSTEMD_USER_UNIT", + "n", "_SYSTEMD_OWNER_UID", + "o", "_SYSTEMD_SLICE", + "p", "_SELINUX_CONTEXT", + "q", "_SOURCE_REALTIME_TIMESTAMP", + "r", "_BOOT_ID",...

This implements new guestfish only command called journal-view. There seems to be a minor issue when user wants to run it through pager (more) and wants cancel it. User will end up with stuck guestfish until journal-view transfers all journal items. Output is now configurable, it's the same format as virt-log has, since both uses same code now. Maros Zatko (1): fish: add journal-view