【问题标题】:Fail2ban errors on Freeswitch logs without dateFail2ban errors on Freeswitch logs without date
【发布时间】:2022-12-19 10:07:12
【问题描述】:

I am trying to configure fail2ban for Freeswithc. Freeswithc logs also some entries without timestamp, like this:

639eacf2-908f-11ec-96f0-f19b85175ba0 2022-02-18 09:50:06.799659 [DEBUG] sofia.c:7084 Channel sofia/LanSideProfile/27124760025@192.16
8.253.99 entering state [received][100]
639eacf2-908f-11ec-96f0-f19b85175ba0 2022-02-18 09:50:06.799659 [DEBUG] sofia.c:7094 Remote SDP:
639eacf2-908f-11ec-96f0-f19b85175ba0 v=0
639eacf2-908f-11ec-96f0-f19b85175ba0 o=FreeSWITCH 1645143180 1645143181 IN IP4 192.168.253.99
639eacf2-908f-11ec-96f0-f19b85175ba0 s=FreeSWITCH
639eacf2-908f-11ec-96f0-f19b85175ba0 c=IN IP4 192.168.253.99
639eacf2-908f-11ec-96f0-f19b85175ba0 t=0 0
639eacf2-908f-11ec-96f0-f19b85175ba0 m=audio 27426 RTP/AVP 0 18 8 101
639eacf2-908f-11ec-96f0-f19b85175ba0 a=rtpmap:0 PCMU/8000
639eacf2-908f-11ec-96f0-f19b85175ba0 a=rtpmap:18 G729/8000
639eacf2-908f-11ec-96f0-f19b85175ba0 a=fmtp:18 annexb=no
639eacf2-908f-11ec-96f0-f19b85175ba0 a=rtpmap:8 PCMA/8000
639eacf2-908f-11ec-96f0-f19b85175ba0 a=rtpmap:101 telephone-event/8000
639eacf2-908f-11ec-96f0-f19b85175ba0 a=fmtp:101 0-15
639eacf2-908f-11ec-96f0-f19b85175ba0 a=silenceSupp:off - - - -
639eacf2-908f-11ec-96f0-f19b85175ba0 a=ptime:20
639eacf2-908f-11ec-96f0-f19b85175ba0 
639eacf2-908f-11ec-96f0-f19b85175ba0 2022-02-18 09:50:06.799659 [DEBUG] switch_core_media.c:4449 Audio Codec Compare [PCMU:0:8000:20:64000:1]/[PCMU:0:8000:20:64000:1]

Fail2Ban encounters errors on these:

2022-02-18 11:19:51,678 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 v=0', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:51,679 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 v=0', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:53,681 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 s=FreeSWITCH', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:53,682 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 s=FreeSWITCH', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:55,685 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 c=IN IP4 192.168.253.98', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:55,685 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 c=IN IP4 192.168.253.98', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:57,688 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 t=0 0', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:57,688 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 t=0 0', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:59,692 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 a=rtpmap:0 PCMU/8000', caught exception: IndexError('string index out of range',)
2022-02-18 11:19:59,693 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 a=rtpmap:0 PCMU/8000', caught exception: IndexError('string index out of range',)
2022-02-18 11:20:01,698 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 a=fmtp:101 0-16', caught exception: IndexError('string index out of range',)
2022-02-18 11:20:01,697 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 a=fmtp:101 0-16', caught exception: IndexError('string index out of range',)
2022-02-18 11:20:03,701 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 a=ptime:20', caught exception: IndexError('string index out of range',)
2022-02-18 11:20:03,702 fail2ban.filter         [16177]: ERROR   Failed to process line: u'639eacf2-908f-11ec-96f0-f19b85175ba0 a=ptime:20', caught exception: IndexError('string index out of range',)

This is most likely because the logs don't have a date. How can I get rid of these errors?

【问题讨论】:

    标签: fail2ban


    【解决方案1】:
    1. Stackoverflow is a inappropriate place for that issue, next time please use https://serverfault.com/, https://superuser.com/ etc instead.
    2. see https://github.com/fail2ban/fail2ban/issues/3020
      Shortly it is fixed in newer versions, but you can workaround it using precise datepattern (like '^S+ {DATE}), if the message you're searching for contain the timestamp, otherwise...
    3. see https://github.com/fail2ban/fail2ban/pull/2814 (released with 0.11.2/0.10.6), for instance set datepattern = {NONE} would allow to find failures totally without date-time in log messages.
    4. 1645143180 is also timestamp (posix unix time since epoch), fail2ban has also a special datepattern for such format (EPOCH or as part of RE {EPOCH}), but you may need also use more precise pattern.

      Anyway I don't see any failure in log, thus don't really know which lines may be interesting here.

    【讨论】:

    • Thank you for the kind reply! The log lines with the SIP SDP message have no date (it's just the uuid and the SDP part). I have fail2ban v0.11.2 and it's supposed to accept lies without dates. After it reaches some of those lines though and generates those IndexError('string index out of range',), it seems to stop matching any good lines.
    • If SO is an inappropriate place for a question, do not answer it, do not upvote it. This simply encourages more off-topic questions in the future. Flag it for closure, and leave a comment for the asker if you wish.
    猜你喜欢
    • 1970-01-01
    • 2022-12-27
    • 1970-01-01
    • 1970-01-01
    • 2022-12-27
    • 2022-12-19
    • 2022-12-02
    • 1970-01-01
    • 1970-01-01
    相关资源
    最近更新 更多