sshguard-users

[SSHGuard-users] Exiting on signal

[Per o. L. <pe...@ne...>]

FreeBSD 10.3-STABLE #0 r306514M
sshguard-pf 1.7.0_1

Got:

Dec  1 02:00:00 <auth.info> terrapin sshguard[28682]: Discarding partial
log entry 'ec  1 02:00:58 <mail.i': source 3356613732 cannot starve the
others.
Dec  1 02:00:00 <auth.err> terrapin sshguard[28682]: Unable to read any
more log entries
Dec  1 02:00:00 <auth.info> terrapin sshguard[28682]: Exiting on signal

It looks like sshguard stumbled when a logfile for vsftpd was rotated at
02:00am. The log in question is gone so apparently som kind of clash
happened.

vsftpd is running in a FreeBSD jail, sshguard on the host.

Any guesses  why this happened?

Thank you,

//per

Re: [SSHGuard-users] Exiting on signal

[Kevin Z. <kev...@gm...>]

On 12/08/2016 23:26, Per olof Ljungmark wrote:
> FreeBSD 10.3-STABLE #0 r306514M
> sshguard-pf 1.7.0_1
> 
> Got:
> 
> Dec  1 02:00:00 <auth.info> terrapin sshguard[28682]: Discarding partial
> log entry 'ec  1 02:00:58 <mail.i': source 3356613732 cannot starve the
> others.
> Dec  1 02:00:00 <auth.err> terrapin sshguard[28682]: Unable to read any
> more log entries
> Dec  1 02:00:00 <auth.info> terrapin sshguard[28682]: Exiting on signal
> 
> It looks like sshguard stumbled when a logfile for vsftpd was rotated at
> 02:00am. The log in question is gone so apparently som kind of clash
> happened.
> 
> vsftpd is running in a FreeBSD jail, sshguard on the host.
> 
> Any guesses  why this happened?

The old log monitor ('LogSuck') is kind of fragile. You should pipe logs
to sshguard using sshg-logmon instead.

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090