Hi Allan, got it... indeed we should stay compliant
what about making it even better:
formatter = logging.Formatter("%(name)s[%(process)d]: %(levelname)-7s
%(message)s")
so we report the pid as well, stay together with the name while still keeping
indentation for the levelname conssitent for easier visual parsing. you can
try attached script to "play" with it.. it should look like
$> ./test-logging.py
Last log lines
Nov 22 13:45:58 novo fail2ban[6554]: WARNING warning msg kjasdhfk jasdh fkjasdh
fkjasdh fkjsdh ilkasjdlfkjasdlkfjlaskdjflaskdjf asldkfjaslkdfjskldfj f
Nov 22 13:45:58 novo fail2ban[6554]: INFO info msg kjasdhfk jasdh fkjasdh
fkjasdh fkjsdh f laksdjflkasjdflkajsdklfjasdlkfjaslkdjflaskdjflkasdjfklasdjfk
On Fri, 22 Nov 2013, Allan Wind wrote:
> Package: fail2ban
> Version: 0.8.6-3wheezy2
> Severity: minor
> I configured fail2ban to log to syslog and would get events like these:
> 2013-11-21T04:24:01.077+00:00 pawan fail2ban.filter : INFO Log
>
>
> rotation detected for /var/log/syslog-ng.log
>
>
> 2013-11-21T15:12:29.713+00:00 pawan fail2ban.jail : INFO Jail
>
>
> 'apache' stopped
>
>
> 2013-11-21T15:12:29.715+00:00 pawan fail2ban.server : INFO
>
>
> Changed logging target to SYSLOG for Fail2ban v0.8.6
>
>
> 2013-11-21T15:12:29.715+00:00 pawan fail2ban.jail : INFO
>
>
> Creating new jail 'apache'
>
>
> 2013-11-21T15:12:29.716+00:00 pawan fail2ban.jail : INFO Jail
>
>
> 'apache' uses poller
>
>
> 2013-11-21T15:12:29.724+00:00 pawan fail2ban.filter : INFO
>
>
> Added logfile = /var/log/syslog-ng.log
>
>
> 2013-11-21T15:12:29.725+00:00 pawan fail2ban.filter : INFO Set
>
>
> maxRetry = 1
>
>
> 2013-11-21T15:12:29.726+00:00 pawan fail2ban.filter : INFO Set
>
>
> findtime = 2592000
>
>
> 2013-11-21T15:12:29.727+00:00 pawan fail2ban.actions: INFO Set
>
>
> banTime = -1
>
>
> Gergely tells me in Bug#725668 that syslog(-ng) will split the ident
> from message on space, so rather than ident being "fail2ban.filter " it
> will be "fail2ban.filter" and the message becomes " : INFO ...." instead
> of the expected "INFO ...". This cause problems for syslog-ng which has
> filtering and flexible logging capabilities.
> The level, "INFO", btw, should not be encoded in the message string, but
> leave that for syslog to record in whatever what it is configured.
> It looks like the action is here:
> server/server.py:
> def setLogTarget(self, target):
> ....
> if target == "SYSLOG":
> # Syslog daemons already add date to the
> message.
> formatter = logging.Formatter("%(name)-16s:
> %(levelname)-6s %(message)s")
> facility =
> logging.handlers.SysLogHandler.LOG_DAEMON
> hdlr =
> logging.handlers.SysLogHandler("/dev/log",
>
> facility = facility)
> where the proposed formatting line should be:
> formatter = logging.Formatter("%(name)s:
> %(message)s")
> Not sure if there is anything else to do to pass the correct logging level to
> syslog.
> -- System Information:
> Debian Release: 7.2
> APT prefers stable-updates
> APT policy: (500, 'stable-updates'), (500, 'stable')
> Architecture: amd64 (x86_64)
> Kernel: Linux 3.2.0-4-amd64 (SMP w/8 CPU cores)
> Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
> Shell: /bin/sh linked to /bin/bash
> Versions of packages fail2ban depends on:
> ii lsb-base 4.1+Debian8+deb7u1
> ii python 2.7.3-4+deb7u1
> ii python-central 0.6.17
> Versions of packages fail2ban recommends:
> ii iptables 1.4.14-3.1
> pn python-gamin <none>
> ii whois 5.0.23
> Versions of packages fail2ban suggests:
> ii mailutils [mailx] 1:2.99.97-3
> -- Configuration Files:
> /etc/fail2ban/fail2ban.conf changed [not included]
> /etc/fail2ban/filter.d/apache-common.conf changed [not included]
> /etc/fail2ban/filter.d/postfix.conf changed [not included]
> /etc/fail2ban/jail.conf changed [not included]
> -- no debconf information
--
Yaroslav O. Halchenko, Ph.D.
http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org
Senior Research Associate, Psychological and Brain Sciences Dept.
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419
WWW: http://www.linkedin.com/in/yarik
#!/usr/bin/python
import logging, logging.handlers, sys, os, signal
formatter = logging.Formatter("%(name)s[%(process)d]: %(levelname)-7s %(message)s")
#formatter = logging.Formatter("%(name)-16s: %(levelname)-6s %(message)s")
facility = logging.handlers.SysLogHandler.LOG_DAEMON
hdlr = logging.handlers.SysLogHandler("/dev/log", facility = facility)
hdlr.setFormatter(formatter)
lgr = logging.getLogger("fail2ban")
lgr.addHandler(hdlr)
lgr.setLevel(logging.DEBUG)
lgr.warning("warning msg kjasdhfk jasdh fkjasdh fkjasdh fkjsdh ilkasjdlfkjasdlkfjlaskdjflaskdjf asldkfjaslkdfjskldfj f")
lgr.info("info msg kjasdhfk jasdh fkjasdh fkjasdh fkjsdh f laksdjflkasjdflkajsdklfjasdlkfjaslkdjflaskdjflkasdjfklasdjfk")
print("Last log lines")
print(''.join( open('/var/log/daemon.log').readlines()[-2:]))
signature.asc
Description: Digital signature
