Just another IT site ※IT系の記事は当方環境での実施内容となるため実施する場合は自己責任でお願いいたします。At Your Own Risk!! TURN BACK WHILE YOU CAN
PR

fail2banのlogrotate時にzabbixが読めるようにする

※IT系の記事は当方環境での実施内容となるため実施する場合は自己責任でお願いいたします。スクリプトはAI生成のものも多いのでコピー&ペーストの際は文字コードに注意ください!

logrotate.d設定

# more /etc/logrotate.d/fail2ban
#
# Gentoo:
# http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
files/fail2ban-logrotate?view=markup
#
# Debian:
# https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.logrotate

/var/log/fail2ban.log {
    create 0640 root zabbix
    missingok
    notifempty
    postrotate
      /usr/bin/fail2ban-client flushlogs >/dev/null || true
    endscript
}

# logrotate -v -f /etc/logrotate.d/fail2ban
reading config file /etc/logrotate.d/fail2ban
Reading state from file: /var/lib/logrotate/logrotate.status
Allocating hash table for state file, size 64 entries
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state

Handling 1 logs

rotating pattern: /var/log/fail2ban.log  forced from command line (no old logs will be kept)
empty log files are not rotated, old logs are removed
considering log /var/log/fail2ban.log
  Now: 2025-01-29 14:30
  Last rotated at 2025-01-26 00:00
  log needs rotating
rotating log /var/log/fail2ban.log, log->rotateCount is 0
dateext suffix '-20250129'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/fail2ban.log.1 to /var/log/fail2ban.log.2 (rotatecount 1, logstart 1, i 1),
old log /var/log/fail2ban.log.1 does not exist
renaming /var/log/fail2ban.log.0 to /var/log/fail2ban.log.1 (rotatecount 1, logstart 1, i 0),
old log /var/log/fail2ban.log.0 does not exist
log /var/log/fail2ban.log.2 doesn't exist -- won't try to dispose of it
renaming /var/log/fail2ban.log to /var/log/fail2ban.log.1
disposeName will be /var/log/fail2ban.log.1
creating new /var/log/fail2ban.log mode = 0640 uid = 0 gid = xxx
running postrotate script
removing old log /var/log/fail2ban.log.1

# ls -la /var/log/fail2ban.log*
-rw-rw---- 1 root zabbix     107 Jan 29 14:30 /var/log/fail2ban.log

【参考】

Linux でログファイルをローテートする #Linux – Qiita

zabbixログ監視設定

ホスト→アイテム→アイテム追加→

名前:fail2banログ監視

タイプ:Zabbixエージェント(アクティブ)

キー:log[“/var/log/fail2ban.log”,”recidive”]

タイトルとURLをコピーしました