Giant fail2ban logs

General Help
1

My /var/log/asterisk/fail2ban file is filling with stuff that looks like this:

814 fail2ban.filter : ERROR No ‘host’ found in ',647 fail2ban.filter : ERROR No ‘host’ found in ',448 fail2ban.filter : ERROR No ‘host’ found in ',172 fail2ban.filter : ERROR No ‘host’ found in ',920 fail2ban.filter : ERROR No ‘host’ found in ',668 fail2ban.filter : ERROR No ‘host’ found in ',429 fail2ban.filter : ERROR No ‘host’ found in ',171 fail2ban.filter : ERROR No ‘host’ found in ',919 fail2ban.filter : ERROR No ‘host’ found in ',666 fail2ban.filter : ERROR No ‘host’ found in ',448 fail2ban.filter : ERROR No ‘host’ found in ',291 fail2ban.filter : ERROR No ‘host’ found in ',127 fail2ban.filter : ERROR No ‘host’ found in ',977 fail2ban.filter : ERROR No ‘host’ found in ',826 fail2ban.filter : ERROR No ‘host’ found in ',674 fail2ban.filter : ERROR No ‘host’ found in ',528 fail2ban.filter : ERROR No ‘host’ found in ',380 fail2ban.filter : ERROR No ‘host’ found in ',221 fail2ban.filter : ERROR No ‘host’ found in ',073 fail2ban.filter : ERROR No ‘host’ found in ',927 fail2ban.filter : ERROR No ‘host’ found in ',777 fail2ban.filter : ERROR No ‘host’ found in ',626 fail2ban.filter : ERROR No ‘host’ found in ',478 fail2ban.filter : ERROR No ‘host’ found in ',319 fail2ban.filter : ERROR No ‘host’ found in ',172 fail2ban.filter : ERROR No ‘host’ found in ',029 fail2ban.filter : ERROR No ‘host’ found in ',882 fail2ban.filter : ERROR No ‘host’ found in ',738 fail2ban.filter : ERROR No ‘host’ found in ',596 fail2ban.filter : ERROR No ‘host’ found in ',452 fail2ban.filter : ERROR No ‘host’ found in ',317 fail2ban.filter : ERROR No ‘host’ found in ',176 fail2ban.filter : ERROR No ‘host’ found in ',040 fail2ban.filter : ERROR No ‘host’ found in ',

Has anyone ever seen this before?

2

Ok, I think the problem stems from my /etc/fail2ban.local file which states:

[Definition]
logtarget = /var/log/asterisk/fail2ban

That’s also the location where asterisk saves sip authorization attempts. So I think fail2ban is reading and writing to it which is a bad thing. Fail2ban should just be logging to /var/log/fail2ban…

I renamed fail2ban.local to fail2ban.local-bak, deleted /var/log/fail2ban and /var/log/asterisk/fail2ban and restarted asterisk and fail2ban.

Things seem to be working better. I wonder why fail2ban.local was aiming fail2ban’s log to a different and wrong location?