NEW Update log with v20 log format

DoliCloud · Mar 26, 2024 · 2a436cb · 2a436cb
1 parent 1c31895
commit 2a436cb
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 7 deletions.
diff --git a/etc/fail2ban/filter.d/web-dolibarr-rulesbruteforce.conf b/etc/fail2ban/filter.d/web-dolibarr-rulesbruteforce.conf
@@ -9,12 +9,13 @@
 
 # To test, you can inject this example into log
 # echo `date +'%Y-%m-%d %H:%M:%S'`" INFO    1.2.3.4         functions_dolibarr::check_user_password_abcd Authentication KO" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" INFO    1.2.3.4         1234567     33 functions_dolibarr::check_user_password_abcd Authentication KO" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
 #
 # then 
 # fail2ban-client status web-dol-bruteforce 
 #
 # To test rule file on a existing log file
 # fail2ban-regex /home/admin/wwwroot/dolibarr_documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulesbruteforce.conf --print-all-matched
 
-failregex = ^ [A-Z\s]+ <HOST>\s+functions_.*::check_user_.* Authentication KO
+failregex = ^ [A-Z\s]+ <HOST>\s.*functions_.*::check_user_.* Authentication KO
 ignoreregex =
diff --git a/etc/fail2ban/filter.d/web-dolibarr-ruleslimitpublic.conf b/etc/fail2ban/filter.d/web-dolibarr-ruleslimitpublic.conf
@@ -6,13 +6,14 @@
 [Definition]
 
 # To test, you can inject this example into log
-# echo `date +'%Y-%m-%d %H:%M:%S'`" NOTICE  1.2.3.4    --- Access to GET /public/clicktodial/cidlookup.php" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" NOTICE  1.2.3.4         --- Access to GET /public/clicktodial/cidlookup.php" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" NOTICE  1.2.3.4         1234567     33 --- Access to GET /public/clicktodial/cidlookup.php" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
 #
 # then 
 # fail2ban-client status web-dolibarr-limitpublic 
 #
 # To test rule file on a existing log file
 # fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-ruleslimitpublic.conf --print-all-matched
 
-failregex = ^ [A-Z\s]+ <HOST>\s+--- Access to .*/public/
+failregex = ^ [A-Z\s]+ <HOST>\s.*--- Access to .*/public/
 ignoreregex =
diff --git a/etc/fail2ban/filter.d/web-dolibarr-rulespassforgotten.conf b/etc/fail2ban/filter.d/web-dolibarr-rulespassforgotten.conf
@@ -8,13 +8,14 @@
 [Definition]
 
 # To test, you can inject this example into log
-# echo `date +'%Y-%m-%d %H:%M:%S'`" NOTICE  1.2.3.4    --- Access to GET /passwordforgotten.php" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" NOTICE  1.2.3.4         --- Access to GET /passwordforgotten.php" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" NOTICE  1.2.3.4         1234567     33 --- Access to GET /passwordforgotten.php" >> /home/admin/wwwroot/dolibarr_documents/dolibarr.log
 #
 # then 
 # fail2ban-client status web-dol-passforgotten 
 #
 # To test rule file on a existing log file
 # fail2ban-regex /home/admin/wwwroot/dolibarr_documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulespassforgotten.conf --print-all-matched
 
-failregex = ^ [A-Z\s]+ <HOST>\s+--- Access to .*/passwordforgotten.php
+failregex = ^ [A-Z\s]+ <HOST>\s.*--- Access to .*/passwordforgotten.php
 ignoreregex =
diff --git a/etc/fail2ban/filter.d/web-dolibarr-rulesregisterinstance.conf b/etc/fail2ban/filter.d/web-dolibarr-rulesregisterinstance.conf
@@ -8,13 +8,14 @@
 [Definition]
 
 # To test, you can inject this example into log
-# echo `date +'%Y-%m-%d %H:%M:%S'`" WARNING 1.2.3.4 Instance creation blocked for 1.2.3.4" >> /home/admin/wwwroot/dolibarr_documents/dolibarr_register.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" WARNING 1.2.3.4         Instance creation blocked for 1.2.3.4" >> /home/admin/wwwroot/dolibarr_documents/dolibarr_register.log
+# echo `date +'%Y-%m-%d %H:%M:%S'`" WARNING 1.2.3.4         1234567     33 Instance creation blocked for 1.2.3.4" >> /home/admin/wwwroot/dolibarr_documents/dolibarr_register.log
 #
 # then 
 # fail2ban-client status web-dol-registerinstance 
 #
 # To test rule file on a existing log file
 # fail2ban-regex /home/admin/wwwroot/dolibarr_documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulesregisterinstance.conf --print-all-matched
 
-failregex = ^ [A-Z\s]+ <HOST>\s+Instance creation blocked for
+failregex = ^ [A-Z\s]+ <HOST>\s.*Instance creation blocked for
 ignoreregex =