Bonjour,
J'avoue que je suis interloqué, j'ai installé un serveur hier, fais les quelques installation de sécurisation, notamment fail2ban...
Aujourd'hui j'importe une base mysql et ça plante : no space left !
Je ne comprends pas pourquoi car ça ne devrait pas dépasser les 17Go d'occupation au total. Je commence donc à chercher et je m'aperçois que le fichier de log de fail2ban fait aujourd'hui 13G ?
C'est possible ça le jour d'après l'installation ?
J'avoue que je ne sais pas interpréter ces logs, voici un extrait :
$ tail -f /var/log/fail2ban.log
2019-03-14 15:34:07,113 fail2ban.filter [835]: HEAVY Looking for match of [('', '2019-03-14 14:25:15,381', ' fail2ban.filter [835]: HEAVY Looking for match of [(\'\', \'2019-03-14 14:19:43,524\', " fail2ban.datedetector [835]: Level 6 got time 1552587534.000000 for \'2019-03-14 14:18:54,082\' using template {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\\\\s*Zone offset)?")]')]
2019-03-14 15:34:07,113 fail2ban.filter [835]: HEAVY Looking for failregex '^((?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?fail2ban\\.actions\\s*(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?fail2ban\\.actions\\s*(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?| fail2ban\\.actions\\s*(?:\\[\\d+\\])?:\\s+)NOTICE\\s+\\[(?!recidive\\])(?:.*)\\]\\s+Ban\\s+(?:(?:::f{4,6}:)?(?P<ip4>(?:\\d{1,3}\\.){3}\\d{1,3})|\\[?(?P<ip6>(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\\]?|(?P<dns>[\\w\\-.^_]*\\w))\\s*$'
2019-03-14 15:34:07,113 fail2ban.filter [835]: TRACE Working on line "2019-03-14 14:25:15,381 fail2ban.filter [835]: HEAVY Looking for failregex '^((?:\\\\[\\\\])?\\\\s*(?:<[^.]+\\\\.[^.]+>\\\\s+)?(?:\\\\S+\\\\s+)?(?:kernel: \\\\[ *\\\\d+\\\\.\\\\d+\\\\]\\\\s+)?(?:@vserver_\\\\S+\\\\s+)?(?:(?:(?:\\\\[\\\\d+\\\\])?:\\\\s+[\\\\[\\\\(]?fail2ban\\\\.actions\\\\s*(?:\\\\(\\\\S+\\\\))?[\\\\]\\\\)]?:?|[\\\\[\\\\(]?fail2ban\\\\.actions\\\\s*(?:\\\\(\\\\S+\\\\))?[\\\\]\\\\)]?:?(?:\\\\[\\\\d+\\\\])?:?)\\\\s+)?(?:\\\\[ID \\\\d+ \\\\S+\\\\]\\\\s+)?| fail2ban\\\\.actions\\\\s*(?:\\\\[\\\\d+\\\\])?:\\\\s+)NOTICE\\\\s+\\\\[(?!recidive\\\\])(?:.*)\\\\]\\\\s+Ban\\\\s+(?:(?:::f{4,6}:)?(?P<ip4>(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3})|\\\\[?(?P<ip6>(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\\\\]?|(?P<dns>[\\\\w\\\\-.^_]*\\\\w))\\\\s*$'\n"
2019-03-14 15:34:07,113 fail2ban.datedetector [835]: HEAVY try to match time for line: 2019-03-14 14:25:15,381 fail2ban.filter [835]: HEAVY Looking for failregex '^((?:\\[\\])?\\s*(?:<[^.]+\\.[^.
2019-03-14 15:34:07,113 fail2ban.datedetector [835]: HEAVY try to match last anchored template #00 ...
2019-03-14 15:34:07,114 fail2ban.datedetector [835]: Level 6 matched last time template #00
2019-03-14 15:34:07,114 fail2ban.datedetector [835]: Level 6 got time 1552587915.000000 for '2019-03-14 14:25:15,381' using template {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
2019-03-14 15:34:07,114 fail2ban.filter [835]: HEAVY Looking for match of [('', '2019-03-14 14:25:15,381', " fail2ban.filter [835]: HEAVY Looking for failregex '^((?:\\\\[\\\\])?\\\\s*(?:<[^.]+\\\\.[^.]+>\\\\s+)?(?:\\\\S+\\\\s+)?(?:kernel: \\\\[ *\\\\d+\\\\.\\\\d+\\\\]\\\\s+)?(?:@vserver_\\\\S+\\\\s+)?(?:(?:(?:\\\\[\\\\d+\\\\])?:\\\\s+[\\\\[\\\\(]?fail2ban\\\\.actions\\\\s*(?:\\\\(\\\\S+\\\\))?[\\\\]\\\\)]?:?|[\\\\[\\\\(]?fail2ban\\\\.actions\\\\s*(?:\\\\(\\\\S+\\\\))?[\\\\]\\\\)]?:?(?:\\\\[\\\\d+\\\\])?:?)\\\\s+)?(?:\\\\[ID \\\\d+ \\\\S+\\\\]\\\\s+)?| fail2ban\\\\.actions\\\\s*(?:\\\\[\\\\d+\\\\])?:\\\\s+)NOTICE\\\\s+\\\\[(?!recidive\\\\])(?:.*)\\\\]\\\\s+Ban\\\\s+(?:(?:::f{4,6}:)?(?P<ip4>(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3})|\\\\[?(?P<ip6>(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\\\\]?|(?P<dns>[\\\\w\\\\-.^_]*\\\\w))\\\\s*$'")]
2019-03-14 15:34:07,114 fail2ban.filter [835]: HEAVY Looking for failregex '^((?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?fail2ban\\.actions\\s*(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?fail2ban\\.actions\\s*(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?| fail2ban\\.actions\\s*(?:\\[\\d+\\])?:\\s+)NOTICE\\s+\\[(?!recidive\\])(?:.*)\\]\\s+Ban\\s+(?:(?:::f{4,6}:)?(?P<ip4>(?:\\d{1,3}\\.){3}\\d{1,3})|\\[?(?P<ip6>(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\\]?|(?P<dns>[\\w\\-.^_]*\\w))\\s*$'
2019-03-14 15:34:07,114 fail2ban.filter [835]: TRACE Worki
Oupsss,
Je viens de vider ce fichier et il grandit à nouveau de Mo en Mo toutes les secondes ??
Je l'ai vidé il y a à peine 2 minutes et voici ce qu'il pèse, 929 Mo :
-rw-r----- 1 root adm 929M Mar 14 17:49 fail2ban.log
Qu'est ce qui se passe ? On m'attaque ou est-ce un bug ??
