FM / logs

/usr/lib/python3/dist-packages/fail2ban/tests/files/logs/

/usr/lib/python3/dist-packages/fail2ban/tests/files/logs

Name	Size	Mode	Actions
bsd/	-	0755	rm
3proxy	575	0644	edit dl rm
apache-auth	12805	0644	edit dl rm
apache-badbots	688	0644	edit dl rm
apache-botsearch	3750	0644	edit dl rm
apache-fakegooglebot	480	0644	edit dl rm
apache-modsecurity	2655	0644	edit dl rm
apache-nohome	406	0644	edit dl rm
apache-noscript	2702	0644	edit dl rm
apache-overflows	2476	0644	edit dl rm
apache-pass	273	0644	edit dl rm
apache-shellshock	499	0644	edit dl rm
assp	5209	0644	edit dl rm
asterisk	13683	0644	edit dl rm
bitwarden	741	0644	edit dl rm
centreon	252	0644	edit dl rm
counter-strike	399	0644	edit dl rm
courier-auth	1070	0644	edit dl rm
courier-smtp	1735	0644	edit dl rm
cyrus-imap	2455	0644	edit dl rm
directadmin	835	0644	edit dl rm
domino-smtp	1295	0644	edit dl rm
dovecot	11017	0644	edit dl rm
dropbear	1329	0644	edit dl rm
drupal-auth	788	0644	edit dl rm
ejabberd-auth	1490	0644	edit dl rm
exim	10145	0644	edit dl rm
exim-spam	3462	0644	edit dl rm
freeswitch	2390	0644	edit dl rm
froxlor-auth	354	0644	edit dl rm
gitlab	392	0644	edit dl rm
grafana	564	0644	edit dl rm
groupoffice	309	0644	edit dl rm
gssftpd	176	0644	edit dl rm
guacamole	1016	0644	edit dl rm
haproxy-http-auth	943	0644	edit dl rm
horde	567	0644	edit dl rm
kerio	3304	0644	edit dl rm
lighttpd-auth	788	0644	edit dl rm
mongodb-auth	2053	0644	edit dl rm
monit	2411	0644	edit dl rm
murmur	702	0644	edit dl rm
mysqld-auth	3696	0644	edit dl rm
nagios	226	0644	edit dl rm
named-refused	2605	0644	edit dl rm
nginx-botsearch	2705	0644	edit dl rm
nginx-http-auth	1727	0644	edit dl rm
nginx-limit-req	1171	0644	edit dl rm
nsd	389	0644	edit dl rm
openhab	692	0644	edit dl rm
openwebmail	615	0644	edit dl rm
oracleims	1843	0644	edit dl rm
pam-generic	2429	0644	edit dl rm
perdition	589	0644	edit dl rm
php-url-fopen	314	0644	edit dl rm
phpmyadmin-syslog	177	0644	edit dl rm
portsentry	341	0644	edit dl rm
postfix	13300	0644	edit dl rm
proftpd	2946	0644	edit dl rm
pure-ftpd	195	0644	edit dl rm
qmail	830	0644	edit dl rm
recidive	1409	0644	edit dl rm
roundcube-auth	5555	0644	edit dl rm
scanlogd	854	0644	edit dl rm
screensharingd	1118	0644	edit dl rm
selinux-ssh	3436	0644	edit dl rm
sendmail-auth	2191	0644	edit dl rm
sendmail-reject	10485	0644	edit dl rm
sieve	535	0644	edit dl rm
slapd	1146	0644	edit dl rm
softethervpn	648	0644	edit dl rm
sogo-auth	3552	0644	edit dl rm
solid-pop3d	1626	0644	edit dl rm
squid	895	0644	edit dl rm
squirrelmail	197	0644	edit dl rm
sshd	32903	0644	edit dl rm
sshd-journal	24396	0644	edit dl rm
stunnel	267	0644	edit dl rm
suhosin	1288	0644	edit dl rm
tine20	520	0644	edit dl rm
traefik-auth	1853	0644	edit dl rm
uwimap-auth	1545	0644	edit dl rm
vsftpd	1122	0644	edit dl rm
webmin-auth	640	0644	edit dl rm
wuftpd	631	0644	edit dl rm
xinetd-fail	331	0644	edit dl rm
znc-adminlog	708	0644	edit dl rm
zoneminder	230	0644	edit dl rm
zzz-generic-example	4245	0644	edit dl rm
zzz-sshd-obsolete-multiline	36	0644	edit dl rm

Edit: /usr/lib/python3/dist-packages/fail2ban/tests/files/logs/kerio (3304B)

# failJSON: { "time": "2011-06-17T17:00:45", "match": true, "host": "200.90.149.178" }
[17/Jun/2011 17:00:45] Attempt to deliver to unknown recipient <advertise@aplawrence.com>, from <bekytnabvnvyx@aapug.org>, IP address 200.90.149.178

# failJSON: { "time": "2014-01-18T06:41:25", "match": true, "host": "202.169.236.195" }
[18/Jan/2014 06:41:25] SMTP Spam attack detected from 202.169.236.195, client closed connection before SMTP greeting

# failJSON: { "time": "2014-01-18T06:42:12", "match": true, "host": "115.147.104.13" }
[18/Jan/2014 06:42:12] SMTP Spam attack detected from 115.147.104.13, client sent data before SMTP greeting

# failJSON: { "time": "2014-01-18T05:47:17", "match": true, "host": "112.140.49.130" }
[18/Jan/2014 05:47:17] IP address 112.140.49.130 found in DNS blacklist UCEProtect1, mail from <infootransac@yahoo.com.hk> to <advertise@aplawrence.com>

# failJSON: { "time": "2014-01-18T06:39:44", "match": true, "host": "91.232.105.66" }
[18/Jan/2014 06:39:44] IP address 91.232.105.66 found in DNS blacklist BarracudaCentral, mail from <postmaster@ponetn.us> to <advertise@aplawrence.com>

# failJSON: { "time": "2013-12-30T05:27:59", "match": true, "host": "64.31.59.75" }
[30/Dec/2013 05:27:59] Relay attempt from IP address 64.31.59.75, mail from <smtp2001soho@yahoo.com> to <reply-abuse@bol.com.br> rejected

# failJSON: { "time": "2013-12-30T19:24:28", "match": true, "host": "74.63.193.116" }
[30/Dec/2013 19:24:28] Relay attempt from IP address 74.63.193.116, mail from <smtp2001soho@yahoo.com> to <reply-abuse@bol.com.br> rejected

# failJSON: { "time": "2013-12-13T00:22:45", "match": true, "host": "23.108.148.156" }
[13/Dec/2013 00:22:45] Attempt to deliver to unknown recipient <suzanne@aplawrence.com>, from <info@kaimingjx.com>, IP address 23.108.148.156

# failJSON: { "time": "2013-12-13T01:11:04", "match": true, "host": "218.85.253.185" }
[13/Dec/2013 01:11:04] Attempt to deliver to unknown recipient <marge@aplawrence.com>, from <yu@rrd.com>, IP address 218.85.253.185

# failJSON: { "time": "2017-05-29T17:29:29", "match": true, "host": "185.140.108.56" }
[29/May/2017 17:29:29] IP address 185.140.108.56 found in DNS blacklist SpamCop, mail from <noreply-tjgqNffcgPfpbZtpDzasm@oakspaversusa.com> to <info@verinion.com> rejected

# failJSON: { "time": "2017-05-17T19:43:42", "match": true, "host": "185.140.108.26" }
[17/May/2017 19:43:42] SMTP: User printer@verinion.com doesn't exist. Attempt from IP address 185.140.108.26.

# failJSON: { "time": "2017-05-17T19:44:25", "match": true, "host": "184.171.168.211" }
[17/May/2017 19:44:25] Client with IP address 184.171.168.211 has no reverse DNS entry, connection rejected before SMTP greeting

# failJSON: { "time": "2017-05-17T19:45:27", "match": true, "host": "170.178.167.136" }
[17/May/2017 19:45:27] Administration login into Web Administration from 170.178.167.136 failed: IP address not allowed

# failJSON: { "time": "2017-05-17T22:14:57", "match": true, "host": "67.211.219.82" }
[17/May/2017 22:14:57] Message from IP address 67.211.219.82, sender <promo123@goodresponse.site> rejected: sender domain does not exist

# failJSON: { "time": "2017-05-18T07:25:15", "match": true, "host": "212.92.127.112" }
[18/May/2017 07:25:15] Failed SMTP login from 212.92.127.112 with SASL method CRAM-MD5.

# failJSON: { "time": "2011-06-17T17:00:45", "match": true, "host": "200.90.149.178" } [17/Jun/2011 17:00:45] Attempt to deliver to unknown recipient , from , IP address 200.90.149.178 # failJSON: { "time": "2014-01-18T06:41:25", "match": true, "host": "202.169.236.195" } [18/Jan/2014 06:41:25] SMTP Spam attack detected from 202.169.236.195, client closed connection before SMTP greeting # failJSON: { "time": "2014-01-18T06:42:12", "match": true, "host": "115.147.104.13" } [18/Jan/2014 06:42:12] SMTP Spam attack detected from 115.147.104.13, client sent data before SMTP greeting # failJSON: { "time": "2014-01-18T05:47:17", "match": true, "host": "112.140.49.130" } [18/Jan/2014 05:47:17] IP address 112.140.49.130 found in DNS blacklist UCEProtect1, mail from to # failJSON: { "time": "2014-01-18T06:39:44", "match": true, "host": "91.232.105.66" } [18/Jan/2014 06:39:44] IP address 91.232.105.66 found in DNS blacklist BarracudaCentral, mail from to # failJSON: { "time": "2013-12-30T05:27:59", "match": true, "host": "64.31.59.75" } [30/Dec/2013 05:27:59] Relay attempt from IP address 64.31.59.75, mail from to rejected # failJSON: { "time": "2013-12-30T19:24:28", "match": true, "host": "74.63.193.116" } [30/Dec/2013 19:24:28] Relay attempt from IP address 74.63.193.116, mail from to rejected # failJSON: { "time": "2013-12-13T00:22:45", "match": true, "host": "23.108.148.156" } [13/Dec/2013 00:22:45] Attempt to deliver to unknown recipient , from , IP address 23.108.148.156 # failJSON: { "time": "2013-12-13T01:11:04", "match": true, "host": "218.85.253.185" } [13/Dec/2013 01:11:04] Attempt to deliver to unknown recipient , from , IP address 218.85.253.185 # failJSON: { "time": "2017-05-29T17:29:29", "match": true, "host": "185.140.108.56" } [29/May/2017 17:29:29] IP address 185.140.108.56 found in DNS blacklist SpamCop, mail from to rejected # failJSON: { "time": "2017-05-17T19:43:42", "match": true, "host": "185.140.108.26" } [17/May/2017 19:43:42] SMTP: User printer@verinion.com doesn't exist. Attempt from IP address 185.140.108.26. # failJSON: { "time": "2017-05-17T19:44:25", "match": true, "host": "184.171.168.211" } [17/May/2017 19:44:25] Client with IP address 184.171.168.211 has no reverse DNS entry, connection rejected before SMTP greeting # failJSON: { "time": "2017-05-17T19:45:27", "match": true, "host": "170.178.167.136" } [17/May/2017 19:45:27] Administration login into Web Administration from 170.178.167.136 failed: IP address not allowed # failJSON: { "time": "2017-05-17T22:14:57", "match": true, "host": "67.211.219.82" } [17/May/2017 22:14:57] Message from IP address 67.211.219.82, sender rejected: sender domain does not exist # failJSON: { "time": "2017-05-18T07:25:15", "match": true, "host": "212.92.127.112" } [18/May/2017 07:25:15] Failed SMTP login from 212.92.127.112 with SASL method CRAM-MD5.