[Freeswitch-users] log format change breaking fail2ban? percentage added to logs? how to revert?

Tue Nov 2 13:10:42 UTC 2021

Thank You Martin!

_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?( 
\d+\.\d\d%%)?

# fail2ban-client status freeswitch
Status for the jail: freeswitch
|- Filter
|  |- Currently failed:	5
|  |- Total failed:	3789
|  `- File list:	/var/log/freeswitch/freeswitch.log
`- Actions
    |- Currently banned:	1
    |- Total banned:	114
    `- Banned IP list:	217.138.199.182

Kind regards,

Jelle de Jong

On 11/1/21 11:46 AM, Martin Paterson wrote:
>   _pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?( \d+\.\d\d%%)?
> works for me.
> 
> Martin Paterson, Pattersong Music
> Reduced orchestrations of G&S
> 
> On Fri, 29 Oct 2021 at 21:21, Jelle de Jong <jelledejong at powercraft.nl> wrote:
>>
>> Thank you Dragos, looking at the commits there is no configure option to
>> change the new behaviour.
>>
>> I tried creating a new regex line based on the added percentage
>>
>> _pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+ \d+\.\d+%%)?
>>
>> I can not get it to work successfully any-more, if someone has a updated
>> fail2ban filter for the new log format please share.
>>
>> Kind regards,
>>
>> Jelle de Jong
>>
>> On 10/29/21 12:20 PM, Dragos Oancea wrote:
>>> It adds idle cpu to log lines.
>>> check commits 03d5730ffcdd0dc69247693c58239757623b9319
>>> and 241d397e39fad336c13b0f43fecfa697182a4a3b if you wish to revert.
>>>
>>>
>>> On Thu, Oct 28, 2021 at 1:42 PM Jelle de Jong <jelledejong at powercraft.nl
>>> <mailto:jelledejong at powercraft.nl>> wrote:
>>>
>>>      Hello everybody,
>>>
>>>      The log format seem to have changed, how can I get it back to what it
>>>      used to without the percentage thing? A search on Google failed me to
>>>      provide an answer...
>>>
>>>      # fs_cli -x version
>>>      FreeSWITCH Version 1.10.7-release-19-883d2cb662~64bit
>>>      (-release-19-883d2cb662 64bit)
>>>
>>>      # grep pref_line  /etc/fail2ban/filter.d/freeswitch.conf
>>>      _pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?
>>>      failregex = %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ SIP auth
>>>      (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\'
>>>      for
>>>      \[[^\]]*\] from ip <HOST>$
>>>                    %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ Can't find
>>>      user
>>>      \[[^@]+@[^\]]+\] from <HOST>$
>>>
>>>      2021-10-28 12:28:55.736515 99.20% [WARNING] sofia_reg.c:1806 SIP auth
>>>      failure (REGISTER) on sofia profile 'internal' for
>>>      [30640 at 82.94.245.xxx]
>>>      from ip 217.138.220.158
>>>
>>>      2021-05-20 16:44:54.159814 [WARNING] sofia_reg.c:1740 SIP auth failure
>>>      (REGISTER) on sofia profile 'internal' for [123456 at 82.94.245.xxx] from
>>>      ip 193.107.216.182
>>>
>>>      # fgrep percentage /etc/freeswitch/ -R
>>>
>>>      What is the use case of this new percentage in the log files?
>>>
>>>      Kind regards,
>>>
>>>      Jelle de Jong
>>>
>>>      _________________________________________________________________________
>>>
>>>      The FreeSWITCH project is sponsored by SignalWire
>>>      https://signalwire.com <https://signalwire.com>
>>>      Enhance your FreeSWITCH install with disruptive priced SMS and PSTN
>>>      services.
>>>      Build your next product on our scalable cloud platform.
>>>
>>>      Join our online community to chat in real time
>>>      https://signalwire.community <https://signalwire.community>
>>>
>>>      Professional FreeSWITCH Services
>>>      sales at freeswitch.com <mailto:sales at freeswitch.com>
>>>      https://freeswitch.com <https://freeswitch.com>
>>>
>>>      Official FreeSWITCH Sites
>>>      https://freeswitch.com/oss <https://freeswitch.com/oss>
>>>      https://freeswitch.org/confluence <https://freeswitch.org/confluence>
>>>      https://cluecon.com <https://cluecon.com>
>>>
>>>      FreeSWITCH-users mailing list
>>>      FreeSWITCH-users at lists.freeswitch.org
>>>      <mailto:FreeSWITCH-users at lists.freeswitch.org>
>>>      http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>>      <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>
>>>      UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>>      <http://lists.freeswitch.org/mailman/options/freeswitch-users>
>>>      https://freeswitch.com <https://freeswitch.com>
>>>
>>>
>>> _________________________________________________________________________
>>>
>>> The FreeSWITCH project is sponsored by SignalWire https://signalwire.com
>>> Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services.
>>> Build your next product on our scalable cloud platform.
>>>
>>> Join our online community to chat in real time https://signalwire.community
>>>
>>> Professional FreeSWITCH Services
>>> sales at freeswitch.com
>>> https://freeswitch.com
>>>
>>> Official FreeSWITCH Sites
>>> https://freeswitch.com/oss
>>> https://freeswitch.org/confluence
>>> https://cluecon.com
>>>
>>> FreeSWITCH-users mailing list
>>> FreeSWITCH-users at lists.freeswitch.org
>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>> https://freeswitch.com
>>>
>>
>> _________________________________________________________________________
>>
>> The FreeSWITCH project is sponsored by SignalWire https://signalwire.com
>> Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services.
>> Build your next product on our scalable cloud platform.
>>
>> Join our online community to chat in real time https://signalwire.community
>>
>> Professional FreeSWITCH Services
>> sales at freeswitch.com
>> https://freeswitch.com
>>
>> Official FreeSWITCH Sites
>> https://freeswitch.com/oss
>> https://freeswitch.org/confluence
>> https://cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> https://freeswitch.com
> 
> _________________________________________________________________________
> 
> The FreeSWITCH project is sponsored by SignalWire https://signalwire.com
> Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services.
> Build your next product on our scalable cloud platform.
> 
> Join our online community to chat in real time https://signalwire.community
> 
> Professional FreeSWITCH Services
> sales at freeswitch.com
> https://freeswitch.com
> 
> Official FreeSWITCH Sites
> https://freeswitch.com/oss
> https://freeswitch.org/confluence
> https://cluecon.com
> 
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> https://freeswitch.com
> 