[Freeswitch-users] log format change breaking fail2ban? percentage added to logs? how to revert?

[Jelle de Jong]

Thank you Dragos, looking at the commits there is no configure option to 
change the new behaviour.

I tried creating a new regex line based on the added percentage

_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+ \d+\.\d+%%)?

I can not get it to work successfully any-more, if someone has a updated 
fail2ban filter for the new log format please share.

Kind regards,

Jelle de Jong

On 10/29/21 12:20 PM, Dragos Oancea wrote:
> It adds idle cpu to log lines.
> check commits 03d5730ffcdd0dc69247693c58239757623b9319 
> and 241d397e39fad336c13b0f43fecfa697182a4a3b if you wish to revert.
> 
> 
> On Thu, Oct 28, 2021 at 1:42 PM Jelle de Jong <jelledejong at powercraft.nl 
> <mailto:jelledejong at powercraft.nl>> wrote:
> 
>     Hello everybody,
> 
>     The log format seem to have changed, how can I get it back to what it
>     used to without the percentage thing? A search on Google failed me to
>     provide an answer...
> 
>     # fs_cli -x version
>     FreeSWITCH Version 1.10.7-release-19-883d2cb662~64bit
>     (-release-19-883d2cb662 64bit)
> 
>     # grep pref_line  /etc/fail2ban/filter.d/freeswitch.conf
>     _pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?
>     failregex = %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ SIP auth
>     (failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\'
>     for
>     \[[^\]]*\] from ip <HOST>$
>                   %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ Can't find
>     user
>     \[[^@]+@[^\]]+\] from <HOST>$
> 
>     2021-10-28 12:28:55.736515 99.20% [WARNING] sofia_reg.c:1806 SIP auth
>     failure (REGISTER) on sofia profile 'internal' for
>     [30640 at 82.94.245.xxx]
>     from ip 217.138.220.158
> 
>     2021-05-20 16:44:54.159814 [WARNING] sofia_reg.c:1740 SIP auth failure
>     (REGISTER) on sofia profile 'internal' for [123456 at 82.94.245.xxx] from
>     ip 193.107.216.182
> 
>     # fgrep percentage /etc/freeswitch/ -R
> 
>     What is the use case of this new percentage in the log files?
> 
>     Kind regards,
> 
>     Jelle de Jong
> 
>     _________________________________________________________________________
> 
>     The FreeSWITCH project is sponsored by SignalWire
>     https://signalwire.com <https://signalwire.com>
>     Enhance your FreeSWITCH install with disruptive priced SMS and PSTN
>     services.
>     Build your next product on our scalable cloud platform.
> 
>     Join our online community to chat in real time
>     https://signalwire.community <https://signalwire.community>
> 
>     Professional FreeSWITCH Services
>     sales at freeswitch.com <mailto:sales at freeswitch.com>
>     https://freeswitch.com <https://freeswitch.com>
> 
>     Official FreeSWITCH Sites
>     https://freeswitch.com/oss <https://freeswitch.com/oss>
>     https://freeswitch.org/confluence <https://freeswitch.org/confluence>
>     https://cluecon.com <https://cluecon.com>
> 
>     FreeSWITCH-users mailing list
>     FreeSWITCH-users at lists.freeswitch.org
>     <mailto:FreeSWITCH-users at lists.freeswitch.org>
>     http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>     <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>
>     UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>     <http://lists.freeswitch.org/mailman/options/freeswitch-users>
>     https://freeswitch.com <https://freeswitch.com>
> 
> 
> _________________________________________________________________________
> 
> The FreeSWITCH project is sponsored by SignalWire https://signalwire.com
> Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services.
> Build your next product on our scalable cloud platform.
> 
> Join our online community to chat in real time https://signalwire.community
> 
> Professional FreeSWITCH Services
> sales at freeswitch.com
> https://freeswitch.com
> 
> Official FreeSWITCH Sites
> https://freeswitch.com/oss
> https://freeswitch.org/confluence
> https://cluecon.com
> 
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> https://freeswitch.com
>