Home / server / Questions / 1042810
In Process
TonyG
Asked: 2020-11-17 14:49:38 +0800 CST

Change fail2ban.log log level for a rule/filter

  • 772

Some messages in the fail2ban.log file are set to INFO, where I'd prefer them to be at DEBUG. I don't want some common detail in the logs. For example:

fail2ban.filter  [214912]: INFO [dovecot] Ignore 127.0.0.1 by ignoreself rule

Then there are messages that might be worth elevating from INFO to a level above, not quite WARNING, but more like FYI. Example:

[postfix] Found 1.2.3.4

Primary question: Where can we find information about how to manipulate the log level associated with a rule?

To be clear, I'm not asking about setting the logging level in /etc/fail2ban/fail2ban.local. That is a comparison value, and any log detail set at or above that value gets saved to the Fail2Ban log(s). I'm looking for the rule/filter value that the config value is compared to.

Related/secondary:

  • Where is the code that assigns the log level to specific rules?
  • Can we create more log levels?
  • I understand that "ignoreself" is built-in. Is it a legitimate change to lower ignoreself messages down to DEBUG-level logging?

Thanks.

fail2ban

0 Answers