Sfoglia il codice sorgente

Added faster fail2ban script. Goes through logfiles to find
bans/unbans.

Yannick Boetzel 7 anni fa
parent
commit
e937340bb3
2 ha cambiato i file con 28 aggiunte e 12 eliminazioni
  1. 10 12
      40-fail2ban
  2. 18 0
      40-fail2ban-status

+ 10 - 12
40-fail2ban

@@ -1,18 +1,16 @@
 #!/bin/bash
 
-jails=($(fail2ban-client status | grep "Jail list:" | sed "s/ //g" | awk '{split($2,a,",");for(i in a) print a[i]}'))
-
-out="jail,failed,total,banned,total\n"
+logfile='/var/log/fail2ban.log*'
+mapfile -t lines < <(grep -hioP '(\[[a-z-]+\]) (ban|unban)' $logfile | sort | uniq -c)
+jails=($(printf -- '%s\n' "${lines[@]}" | grep -oP '\[\K[^\]]+' | sort | uniq))
 
+out=""
 for jail in ${jails[@]}; do
-  status=$(fail2ban-client status ${jail})
-  failed=$(echo "$status" | grep -ioP '(?<=Currently failed:\t)[[:digit:]]+')
-  totalfailed=$(echo "$status" | grep -ioP '(?<=Total failed:\t)[[:digit:]]+')
-  banned=$(echo "$status" | grep -ioP '(?<=Currently banned:\t)[[:digit:]]+')
-  totalbanned=$(echo "$status" | grep -ioP '(?<=Total banned:\t)[[:digit:]]+')
-
-  out+="$jail,$failed,$totalfailed,$banned,$totalbanned\n"
+    bans=$(printf -- '%s\n' "${lines[@]}" | grep -iP "[[:digit:]]+ \[$jail\] ban" | awk '{print $1}')
+    unbans=$(printf -- '%s\n' "${lines[@]}" | grep -iP "[[:digit:]]+ \[$jail\] unban" | awk '{print $1}')
+    diff=$(($bans-$unbans))
+    out+=$(printf "$jail, %+3s bans, %+3s unbans, %+3s active" $bans $unbans $diff)"\n"
 done
 
-printf "\nfail2ban status:\n"
-printf $out | column -ts $',' | sed -e 's/^/  /'
+printf "\nfail2ban status (monthly):\n"
+printf "$out" | column -ts $',\n' | sed -e 's/^/  /'

+ 18 - 0
40-fail2ban-status

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+jails=($(fail2ban-client status | grep "Jail list:" | sed "s/ //g" | awk '{split($2,a,",");for(i in a) print a[i]}'))
+
+out="jail,failed,total,banned,total\n"
+
+for jail in ${jails[@]}; do
+  status=$(fail2ban-client status ${jail})
+  failed=$(echo "$status" | grep -ioP '(?<=Currently failed:\t)[[:digit:]]+')
+  totalfailed=$(echo "$status" | grep -ioP '(?<=Total failed:\t)[[:digit:]]+')
+  banned=$(echo "$status" | grep -ioP '(?<=Currently banned:\t)[[:digit:]]+')
+  totalbanned=$(echo "$status" | grep -ioP '(?<=Total banned:\t)[[:digit:]]+')
+
+  out+="$jail,$failed,$totalfailed,$banned,$totalbanned\n"
+done
+
+printf "\nfail2ban status:\n"
+printf $out | column -ts $',' | sed -e 's/^/  /'