Menu
▾
▴
Re: [Fail2ban-users] Error 514
|
From: Yaroslav H. <li...@on...> - 2008-04-29 15:04:13
|
> Yes it reloads fine and then 3 of the 5 modules I am using died. I am sorry - what do you mean by 'died' -- they are not listed in fail2ban-client status ? or they simply don't react on failed logins? when does it die during those proftpd lines you posted? around 11:49 everything is smotth... > I > dont get it. The first module to die according to the fail2ban log is > the proftpd module but here is the log from then > Apr 27 11:49:12 dark.pcsites.com proftpd[29895] dark.pcsites.com > (::ffff:87.252.49.233[::ffff:87.252.49.233]): FTP session opened. > Apr 27 11:49:12 dark.pcsites.com proftpd[29895] dark.pcsites.com > (::ffff:87.252.49.233[::ffff:87.252.49.233]): FTP session closed. > Apr 27 11:49:13 dark.pcsites.com proftpd[29918] dark.pcsites.com > (::ffff:87.252.49.233[::ffff:87.252.49.233]): FTP session opened. > Apr 27 11:49:13 dark.pcsites.com proftpd[29918] dark.pcsites.com > (::ffff:87.252.49.233[::ffff:87.252.49.233]): FTP session closed. > Apr 27 16:49:51 dark.pcsites.com proftpd[1387] dark.pcsites.com: > ProFTPD killed (signal 15) > Apr 27 16:49:51 dark.pcsites.com proftpd[1387] dark.pcsites.com: > ProFTPD 1.3.1 standalone mode SHUTDOWN > Apr 27 16:56:19 dark.pcsites.com proftpd[12088] dark.pcsites.com: > ProFTPD 1.3.1 (stable) (built Sat Oct 6 21:20:37 CEST 2007) standalone > mode STARTUP > Apr 29 10:09:29 dark.pcsites.com proftpd[14247] dark.pcsites.com > (::ffff:64.105.4.154[::ffff:64.105.4.154]): FTP session opened. > http://pcsites.com/mylog/fail2ban.log.1 > http://pcsites.com/mylog/fail2ban.log > logs posted for your perusal. > On Mon, Apr 28, 2008 at 11:26 AM, Yaroslav Halchenko > <li...@on...> wrote: > > well -- fail2ban itself has a logfile which needs to be rotated, thus it > > goes through 'reload' action during rotation which causes it to flush > > everything ,reload configuration and setup everything from scratch. > > Did it refused to work correctly after reload? > > On Sat, 26 Apr 2008, rah...@gm... wrote: > > > On Fri, Apr 25, 2008 at 10:12 AM, Michael Geiger <ge...@mg...> wrote: > > > > Hmm, both systems are virtual - I think Strato is running their vservers > > > > with Virtuozzo by Parallels ... > > > > So what's special about this environment? I had to disable sendfile in > > > > apache and proftpd, could this be the source of this error?? > > > 2008-04-26 01:16:05,676 fail2ban.filter : DEBUG Got event: 1 for > > > /var/log/httpd/pat_access_log > > > 2008-04-26 01:16:05,676 fail2ban.filter : DEBUG File changed: > > > /var/log/httpd/pat_access_log > > > 2008-04-26 01:16:05,677 fail2ban.filter.datedetector: DEBUG Sorting > > > the template list > > > 2008-04-26 01:17:06,998 fail2ban.comm : DEBUG Command: ['ping'] > > > 2008-04-26 01:17:07,437 fail2ban.comm : DEBUG Command: ['stop', 'all'] > > > 2008-04-26 01:17:07,653 fail2ban.filter : DEBUG proftpd-iptables: > > > filter terminated > > > 2008-04-26 01:17:08,357 fail2ban.actions: DEBUG Flush ban list > > > At 1:17 my logrotate script fired off and evidently fail2ban decided > > > that meant it was time to shut down. Seems kind of over sensitive to > > > me? > > > At 1:17 my logs started rotating > > > ------------------------------------------------------------------------- > > > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference > > > Don't miss this year's exciting event. There's still time to save $100. > > > Use priority code J8TL2D2. > > > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > > > _______________________________________________ > > > Fail2ban-users mailing list > > > Fai...@li... > > > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > -- > > .-. > > =------------------------------ /v\ ----------------------------= > > Keep in touch // \\ (yoh@|www.)onerussian.com > > Yaroslav Halchenko /( )\ ICQ#: 60653192 > > Linux User ^^-^^ [175555] > > ------------------------------------------------------------------------- > > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference > > Don't miss this year's exciting event. There's still time to save $100. > > Use priority code J8TL2D2. > > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone > > _______________________________________________ > > Fail2ban-users mailing list > > Fai...@li... > > https://lists.sourceforge.net/lists/listinfo/fail2ban-users -- .-. =------------------------------ /v\ ----------------------------= Keep in touch // \\ (yoh@|www.)onerussian.com Yaroslav Halchenko /( )\ ICQ#: 60653192 Linux User ^^-^^ [175555] |