[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Logwatch does not report fail2ban on Debian 12



On Debian 10 and 11 hosts the e-mail logwatch generates has section like this:

--------------------- fail2ban-messages Begin ------------------------


 Banned services with Fail2Ban:                             Bans:Unbans
    postfix-sasl:                                           [  3:3  ]
    recidive:                                               [ 88:155]
    sshd:                                                   [296:296]

 ---------------------- fail2ban-messages End -------------------------

On Debian 12, that section does not appear.

I have compared settings between hosts, I can not see difference. I tried to seem if fail2ban log format has changed, but they look the same to me. Troubleshooting on the Debian 12 host with

# logwatch --debug High --service fail2ban

shows logfile with the fail2ban info is read and the filter finds Ban, Unban etc. lines. With --debug High the resulting e-mail did have fail2ban-messages section, but still not the summary lines with numbers of Bans:Unbans.

Is this a known issue, some configuration needs adjustment?

My Debian 12 host is NOT upgraded from Debian 11, it is a fresh install. I did read Debian 12 Release notes, but can not find it mentioning logwatch or fail2ban.
--
Tapio Lehtonen / Pori
Sampolan ATK


Reply to: