2

I've set up fail2ban on a centos VPS used for a few mail accounts among other things and want to check that everything is running smoothly. According to fail2ban-client status everything is running as expected on dovecot, exim, and ssh, but there's no log file in the expected place (/var/log/fail2ban.log), and find / -name fail2ban.log finds nothing.

fail2ban-client get loglevel returns Current logging level is 'INFO', and fail2ban-client get logtarget returns Current logging target is:- SYSLOG. Based on this, it should be logging in the default location, which all the docs and guides I've found say is /var/log/fail2ban.log, but no log file is there.

There have been many of the usual probes on dovecot since setting fail2ban up including many from repeat IPs, so it's not like fail2ban has had nothing to do.

How can I investigate why fail2ban has not got any log file and appears to be failing to log? Searches uncovered a few people posting about similar problems on a few forums but no solutions I could see.

  • 2
    The location of the log depends on your syslog implementation and configuration. Did you look in /var/log/messages which is now the most common place. Note that troubleshooting fail2ban is not an easy task unless you make a good effort in understanding how it works. – Julie Pelletier Jan 10 '17 at 15:35
  • Which CentOS version do you use? Does it include systemd? – Tombart Jan 10 '17 at 15:38
  • I don't have a /var/log/messages directory, and a system-wide find didn't find it, so I'm pretty sure it's not being created, rather than I'm looking in the wrong place. rpm --query centos-release gives centos-release-6-7.el6.centos.12.3.x86_64, no systemd – user568458 Jan 10 '17 at 15:41
  • /var/log/messages is a file, not a directory. can you paste the contents of /var/log ? – schaiba Jan 10 '17 at 15:43
  • @schaiba Oops, yes I do have that file and it does contain fail2ban logging messages. Looks like I was simply looking at out-of-date docs and discussions that all talked about a standalone fail2ban.log file, /var/log/messages is the answer – user568458 Jan 10 '17 at 15:47
3

The location of the log depends on your syslog implementation and configuration.

/var/log/messages is the most common place.

Note that troubleshooting fail2ban is not an easy task unless you make a good effort in understanding how it works.

3

If you want your Fail2ban to write logs to: /var/log/fail2ban.log

  1. Open the /etc/fail2ban/fail2ban.conf file

  2. Change the line: logtarget = SYSLOG to logtarget = /var/log/fail2ban.log

  3. restart fail2ban service

Fail2ban will start writing logs to the /var/log/fail2ban.log file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.