VoIP Mailing List Archives

[jelledejong at powercr...]

Hello everybody,

The log format seem to have changed, how can I get it back to what it
used to without the percentage thing? A search on Google failed me to
provide an answer...

# fs_cli -x version
FreeSWITCH Version 1.10.7-release-19-883d2cb662~64bit
(-release-19-883d2cb662 64bit)

# grep pref_line /etc/fail2ban/filter.d/freeswitch.conf
_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?
failregex = %(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ SIP auth
(failure|challenge) \((REGISTER|INVITE)\) on sofia profile \'[^']+\' for
\[[^\]]*\] from ip <HOST>$
%(_pref_line)s \[WARNING\] sofia_reg\.c:\d+ Can't find user
\[[^@]+@[^\]]+\] from <HOST>$

2021-10-28 12:28:55.736515 99.20% [WARNING] sofia_reg.c:1806 SIP auth
failure (REGISTER) on sofia profile 'internal' for [30640@82.94.245.xxx]
from ip 217.138.220.158

2021-05-20 16:44:54.159814 [WARNING] sofia_reg.c:1740 SIP auth failure
(REGISTER) on sofia profile 'internal' for [123456@82.94.245.xxx] from
ip 193.107.216.182

# fgrep percentage /etc/freeswitch/ -R

What is the use case of this new percentage in the log files?

Kind regards,

Jelle de Jong

_________________________________________________________________________

The FreeSWITCH project is sponsored by SignalWire https://signalwire.com
Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services.
Build your next product on our scalable cloud platform.

Join our online community to chat in real time https://signalwire.community

Professional FreeSWITCH Services
sales@freeswitch.com
https://freeswitch.com

Official FreeSWITCH Sites
https://freeswitch.com/oss
https://freeswitch.org/confluence
https://cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
https://freeswitch.com

[dragos at freeswitch.org]

It adds idle cpu to log lines.
check commits 03d5730ffcdd0dc69247693c58239757623b9319 and 241d397e39fad336c13b0f43fecfa697182a4a3b if you wish to revert.



On Thu, Oct 28, 2021 at 1:42 PM Jelle de Jong <jelledejong@powercraft.nl (jelledejong@powercraft.nl)> wrote:

[jelledejong at powercr...]

Thank you Dragos, looking at the commits there is no configure option to
change the new behaviour.

I tried creating a new regex line based on the added percentage

_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+ \d+\.\d+%%)?

I can not get it to work successfully any-more, if someone has a updated
fail2ban filter for the new log format please share.

Kind regards,

Jelle de Jong

On 10/29/21 12:20 PM, Dragos Oancea wrote:

[martin at pattersong.c...]

Yikes! That change silently breaks the fail2ban log line match,
meaning no IP addresses will get banned any more.

I've raised an issue on the fail2ban project (which holds the config
files that match these - and many other products' - log lines) and
added a note to the release notes in Confluence.

Watch out that debian buster packages only an earlier version of
fail2ban, so even when fail2ban release an updated version, you may
have to fetch it manually.

Martin Paterson, Pattersong Music
Reduced orchestrations of G&S


On Fri, 29 Oct 2021 at 11:20, Dragos Oancea <dragos@freeswitch.org> wrote:

[martin at pattersong.c...]

_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?( \d+\.\d\d%%)?
works for me.

Martin Paterson, Pattersong Music
Reduced orchestrations of G&S

On Fri, 29 Oct 2021 at 21:21, Jelle de Jong <jelledejong@powercraft.nl> wrote:

[Antony.Stone at freesw...]

On Friday 29 October 2021 at 12:20:36, Dragos Oancea wrote:

[jelledejong at powercr...]

Thank You Martin!

_pref_line = ^%(__prefix_line)s(?:\d+-\d+-\d+ \d+:\d+:\d+\.\d+)?(
\d+\.\d\d%%)?

# fail2ban-client status freeswitch
Status for the jail: freeswitch
|- Filter
| |- Currently failed: 5
| |- Total failed: 3789
| `- File list: /var/log/freeswitch/freeswitch.log
`- Actions
|- Currently banned: 1
|- Total banned: 114
`- Banned IP list: 217.138.199.182

Kind regards,

Jelle de Jong

On 11/1/21 11:46 AM, Martin Paterson wrote: