From: eBulldog O. <op...@eb...> - 2024-04-10 13:39:29
|
Hi and thanks for reading ... I've scoured the usual sources and whilst I'm convinced I'm not the first with this config challenge, I can't find anything appropriate. The issue appears to be the additional fields (timestamp/hostname/process) that journal is adding to the original dovecot log lines. Now there's a bunch of work arounds for this but I'm trying to avoid hacks and also convinced fail2ban can handle this in itself (and I'm just being dumb). Currently exploring the common.conf macro's and how they work (e.g. logtype = journal) and if/how this could be modified to handle journal entries but my assumption is I'm missing something obvious as I can't imagine I'm the first to need to filter out the additional fields for the regex to work out of the box. If anyone has any pointers here it will be much appreciated, an hour or two saved as I'm burning through them ;) Some more detail ... Dovecot docker container logging to stdout (no rsyslog in the middle), docker configured to log to journal. -docker logs: Apr 10 13:10:14 submission-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 23 secs): user=<squ...@yo...>, method=LOGIN, rip=194.169.175.10, lip=172.20.0.4, TLS: Connection closed, session=<EzX/wL0V8KnCqa8K> -journal logs: Apr 10 13:10:14 toad be63bba8ba56[2836635]: Apr 10 13:10:14 submission-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 23 secs): user=<squ...@yo...>, method=LOGIN, rip=194.169.175.10, lip=172.20.0.4, TLS: Connection closed, session=<EzX/wL0V8KnCqa8K> NOTE: additonal timestamp etc - Control test: journalctl -u docker.service CONTAINER_NAME=ms-dovecot --output cat > dovecot-native.logs fail2ban-regex ./dovecot-native.logs dovecot NOTE: everything works, 100's of Failregex counted (14k lines via Prefregex) fail2ban-regex systemd-journal -m 'CONTAINER_NAME=ms-dovecot' dovecot NOTE: Prefregex counts 14k lines but zero Failregex. |