Skip to content

Instantly share code, notes, and snippets.

@lucamauri
Last active March 12, 2021 15:38
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lucamauri/e121d2ff1bfc65f3366f5505f7d1f6e1 to your computer and use it in GitHub Desktop.
Save lucamauri/e121d2ff1bfc65f3366f5505f7d1f6e1 to your computer and use it in GitHub Desktop.
Fail2Ban format description for LNav utility
{
"$schema": "https://lnav.org/schemas/format-v1.schema.json",
"fail2ban_log": {
"title": "Fail2Ban Actions Log",
"description": "The log that summarizes the actions of Fail2Ban application.",
"url": "https://www.fail2ban.org/",
"multiline": false,
"regex": {
"f2b-found": {
"pattern": "(?<timestamp>.*) (?<module>fail2ban)\\.(?<feature>.*[^ ])[ \\t]+\\[.*\\]\\: (?<level>.*[^ ])[ \\t]+.* \\[(?<service>.*)\\] (?<action>Found) (?<host>\\S+)"
},
"f2b-ban": {
"pattern": "(?<timestamp>.*) (?<module>fail2ban)\\.(?<feature>.*[^ ])[ \\t]+\\[.*\\]\\: (?<level>.*[^ ])[ \\t]+.* \\[(?<service>.*)\\] (?<action>Ban) (?<host>\\S+)"
},
"f2b-unban": {
"pattern": "(?<timestamp>.*) (?<module>fail2ban)\\.(?<feature>.*[^ ])[ \\t]+\\[.*\\]\\: (?<level>.*[^ ])[ \\t]+.* \\[(?<service>.*)\\] (?<action>Unban) (?<host>\\S+)"
}
},
"body-field": "feature",
"level-field": "level",
"module-field": "module",
"level": {
"info": "INFO",
"warning": "NOTICE"
},
"value": {
"feature": {
"kind": "string",
"identifier": true,
"description": "The Fail2Ban feature in action"
},
"host": {
"kind": "string",
"collate": "ipaddress",
"identifier": true,
"description": "The client IP address"
},
"action": {
"kind": "string",
"identifier": true,
"description": "The action being performed by Fail2Ban"
},
"service": {
"kind": "string",
"identifier": true,
"description": "The service that generated the entry"
}
},
"sample": [
{
"line": "2021-03-07 00:02:35,052 fail2ban.actions [517]: NOTICE [sshd] Ban 221.181.185.143",
"level": "warning"
},
{
"line": "2021-03-07 00:06:06,331 fail2ban.filter [517]: INFO [sshd] Found 49.234.219.217 - 2021-03-07 00:06:05",
"level": "info"
},
{
"line": "2021-03-07 00:11:37,892 fail2ban.actions [517]: NOTICE [sshd] Unban 222.93.19.206",
"level": "info"
}
]
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment