4

I've set up fail2ban on a centos VPS used for a few mail accounts among other things and want to check that everything is running smoothly. According to fail2ban-client status everything is running as expected on dovecot, exim, and ssh, but there's no log file in the expected place (/var/log/fail2ban.log), and find / -name fail2ban.log finds nothing.

fail2ban-client get loglevel returns Current logging level is 'INFO', and fail2ban-client get logtarget returns Current logging target is:- SYSLOG. Based on this, it should be logging in the default location, which all the docs and guides I've found say is /var/log/fail2ban.log, but no log file is there.

There have been many of the usual probes on dovecot since setting fail2ban up including many from repeat IPs, so it's not like fail2ban has had nothing to do.

How can I investigate why fail2ban has not got any log file and appears to be failing to log? Searches uncovered a few people posting about similar problems on a few forums but no solutions I could see.

6
  • 2
    The location of the log depends on your syslog implementation and configuration. Did you look in /var/log/messages which is now the most common place. Note that troubleshooting fail2ban is not an easy task unless you make a good effort in understanding how it works. Jan 10, 2017 at 15:35
  • Which CentOS version do you use? Does it include systemd?
    – Tombart
    Jan 10, 2017 at 15:38
  • I don't have a /var/log/messages directory, and a system-wide find didn't find it, so I'm pretty sure it's not being created, rather than I'm looking in the wrong place. rpm --query centos-release gives centos-release-6-7.el6.centos.12.3.x86_64, no systemd Jan 10, 2017 at 15:41
  • /var/log/messages is a file, not a directory. can you paste the contents of /var/log ?
    – schaiba
    Jan 10, 2017 at 15:43
  • @schaiba Oops, yes I do have that file and it does contain fail2ban logging messages. Looks like I was simply looking at out-of-date docs and discussions that all talked about a standalone fail2ban.log file, /var/log/messages is the answer Jan 10, 2017 at 15:47

2 Answers 2

4

The location of the log depends on your syslog implementation and configuration.

/var/log/messages is the most common place.

Note that troubleshooting fail2ban is not an easy task unless you make a good effort in understanding how it works.

3

If you want your Fail2ban to write logs to: /var/log/fail2ban.log

  1. Open the /etc/fail2ban/fail2ban.conf file

  2. Change the line: logtarget = SYSLOG to logtarget = /var/log/fail2ban.log

  3. restart fail2ban service

Fail2ban will start writing logs to the /var/log/fail2ban.log file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .