[SOLVED] fail2ban: writing offenders to a file

HQuest · 09-01-2022, 07:20 AM

Hi folks.

While I understand fail2ban can automatically place offenders into firewall policies, how can I make the system write IP addresses into a text file? I know there is the "fail2ban-client banned" command option that shows me a list however it sounds counter-intuitive to have to run something a second time to extract this data.

Thanks.

bathory · 09-01-2022, 08:08 AM

Quote:

Originally Posted by HQuest

Hi folks.

While I understand fail2ban can automatically place offenders into firewall policies, how can I make the system write IP addresses into a text file? I know there is the "fail2ban-client banned" command option that shows me a list however it sounds counter-intuitive to have to run something a second time to extract this data.

Thanks.

AFAIK fail2ban uses /var/log/fail2ban.log to log its actions.

HQuest · 09-01-2022, 08:33 AM

Quote:

Originally Posted by bathory

AFAIK fail2ban uses /var/log/fail2ban.log to log its actions.

Thanks, but then I still need to somehow parse this file for "NOTICE [jail name] Ban x.x.x.x" messages. I'm trying to avoid doing manual parsing.

boughtonp · 09-01-2022, 08:54 AM

You don't want to use the built-in functionality, but you also don't want to parse the logs yourself?

Unless you're going to modify fail2ban-server to implement custom extra logging, I'm fairly sure you have to pick one of those.

What's your reason for wanting to write the IPs to a text file?

HQuest · 09-01-2022, 09:19 AM

Quote:

Originally Posted by boughtonp

You don't want to use the built-in functionality, but you also don't want to parse the logs yourself?

Unless you're going to modify fail2ban-server to implement custom extra logging, I'm fairly sure you have to pick one of those.

What's your reason for wanting to write the IPs to a text file?

I want to get these IPs sent to other systems and exchange this data, so I don't need to wait certain actions to happen before I take action. However, I actually found a way to do it - via action.d/ that I completely forgot. Thanks for the hints, though.