From: Frank B <fr...@gm...> - 2020-02-27 10:57:09
|
Hello, Out of the blue my fail2ban.log got flooded with warnings: === 2020-02-24 09:25:48,283 fail2ban.filter [466]: INFO [wordpress-hard] Found *.*.105.83 - 2020-02-24 09:25:48 2020-02-24 09:25:48,950 fail2ban.actions [466]: NOTICE [wordpress-hard] Ban *.*.105.83 2020-02-24 09:29:01,333 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:30:01,904 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:30:39,628 fail2ban.actions [466]: NOTICE [sshd] Unban *.*.248.127 2020-02-24 09:31:01,421 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:31:45,704 fail2ban.actions [466]: NOTICE [sshd] Unban *.*.88.77 2020-02-24 09:32:01,895 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:32:09,741 fail2ban.actions [466]: NOTICE [sshd] Unban *.*.133.188 2020-02-24 09:33:01,246 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:34:01,661 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:35:01,283 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:36:01,671 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:37:01,375 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:38:02,241 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:39:02,118 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:40:01,766 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:40:34,032 fail2ban.filter [466]: INFO [wordpress-hard] Found *.*.135.88 - 2020-02-24 09:40:33 2020-02-24 09:40:40,313 fail2ban.filter [466]: INFO [wordpress-hard] Found *.*.135.88 - 2020-02-24 09:40:40 2020-02-24 09:40:46,220 fail2ban.filter [466]: INFO [wordpress-hard] Found *.*.135.88 - 2020-02-24 09:40:45 2020-02-24 09:40:46,342 fail2ban.actions [466]: NOTICE [wordpress-hard] Ban *.*.135.88 2020-02-24 09:41:01,277 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) 2020-02-24 09:41:49,313 fail2ban.filter [466]: INFO [postfix] Found *.*.176.82 - 2020-02-24 09:41:49 2020-02-24 09:41:49,582 fail2ban.filter [466]: INFO [postfix] Found *.*.176.82 - 2020-02-24 09:41:49 2020-02-24 09:42:00,427 fail2ban.actions [466]: NOTICE [wordpress-hard] Unban *.*.132.32 2020-02-24 09:42:01,672 fail2ban.transmitter [466]: WARNING Command ['status', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl',) === This looked strange to me, since I've disabled the postfix-rbl jail. Activating this jail and reloading fail2ban stopped the warnings. As far as I know there were no changes on my system, so I started digging deeper and found in apt's history.log: === Start-Date: 2020-02-24 09:28:55 Commandline: apt upgrade Upgrade: monitorix:amd64 (3.11.0-izzy1, 3.12.0-izzy1) End-Date: 2020-02-24 09:28:57 === Notice the timestamps of the first warning and the upgrade of Monitorix to 3.12.0. In monitorix.conf [postfix-rbl] was enabled in the fail2ban graph section. Disabling this and disabling the postfix-rbl jail again (the host of my VPS has limited the number of IP packet filtering entries, so I have to be very selective with my jail setup) fixed the situation. As an added "bonus" I lost the history of my fail2ban graph in Monitorix; all data in the graph before the upgrade is gone. The other graphs are fine. Summary: a disabled jail in fail2ban but enabled in the fail2ban graph section of Monitorix floods fail2ban.log with warnings. I did not try to reproduce this issue with other jails. With kind regards, Frank B. |