NethServer Version: 7.4
I was checking my logs tonight and noticed my fail2ban log was almost a gig. Just from a day.
fail2ban.filterpoll : ERROR Unable to get stat on /var/log/httpd/ssl_error_log-20171007 because of: [Errno 2] No such file or directory: ‘/var/log/httpd/ssl_error_log-20171007’
fail2ban.filterpoll : WARNING Too many errors. Setting the jail idle
It does this hundreds of thousands of times, for the jail, all idle.
fail2ban.filter : WARNING Error decoding line from ‘/var/log/sogo/sogo.log-20171024.gz’ with ‘UTF-8’. Consider setting logencoding=utf-8 (or another appropriate encoding) for this jail. Continuing to process line ignoring invalid characters: ‘\x1f\x8b\x08\x00\x81\xec\xeeY\x00\x03\xed]ko\xdc6\x16\xfd\xde_A\x18X\xb4\xc5n8|J$\xfb\xc0z\xebIj \xb5\x8d\xb1\xbb\xc0"\x08\n’
Thats a SOGO thing.
Any hints as to the issue?
Edit: The issue seems to be that the logfile isnt rotated fast enough (or at all???) and the jail stops. Seems to be only an issue with the httpd jail(?) but from what I can tell it is a fail2ban issue upstream so maybe nothing we can do about it. Maybe we need to investigate if it is actually doing its job because failing to block a ddos or a hack attempt could be dangerous.