Resolved Fail2Ban crashed during the night and won't respond at all

[G J Piper]

I woke to see that Fail2Ban had crashed and won't restart, start, stop, or respond to anything.
I went in and "killall fail2ban-client" but that didn't help.
"plesk repair -all" apparently can't get past "Repairing web server configuration" (sits there forever)
There are no huge log files.
Disk is at only 33% capacity.

Trying to reboot the system but it is taking a long time to shut down...
(15 min already just sitting at "The system is going down for reboot NOW!")

Server is still serving websites somehow...

Forced the container to restart from Parallels Virtual Automation panel.
Any ideas?

Running Onyx 7.5.3#20, CentOS 6.9 (all components updated)

 

[G J Piper]

A complete restart of the container and it seems to be running now. Don't want this happening again though... anyone else had this?

 

[helpchrisplz]

When it crashes i normally do this;

for pid in $(ps -ef | awk '/fail2ban/ {print $2}'); do kill -9 $pid; done

Then wait for 1 min and it should start itself! just check the plesk dashboard page...

It can crash because of the amount of memory it takes up when sniffing all your domains log files. How much ram you got? How many subscriptions you got?



Sent from my SM-G930F using Tapatalk

 

[helpchrisplz]

Fail2ban extension hangs: Failed to stop jail action – Plesk Help Center

Sent from my SM-G930F using Tapatalk

 

[G J Piper]

All my logs are limited to 5mb max specifically to help fail2ban run smoothly. Very low usage on all 30 domains. Memory never exceeds 1.1gig out of the 2gig available.

 

[helpchrisplz]

I have 200 subscriptions and 64GB RAM. I have never been able to turn on the apache badbot jail as it hangs. I haven't done the suggestions in the kb link i shared yet though. You might want to try following that kb guide.

Sent from my SM-G930F using Tapatalk

 

[G J Piper]

My setup has been running continuously for a year and a half without failing until now. Maybe it was a glitch that won't return.

 

[G J Piper]

I think I may have found the culprit. There was one log file not being rotated, and was allowed to grow unchecked despite the GUI settings.
See this for more info:
Nginx SSL access logs not rotated according to GUI settings -- fail2ban suffers

 

[helpchrisplz]

Interesting, it looks like you know your stuff.

I wonder what apache piped logs does or if it effects anything to do with this?


Sent from my SM-G930F using Tapatalk

 

[G J Piper]

Interesting, it looks like you know your stuff.

I wonder what apache piped logs does or if it effects anything to do with this?

It won't have anything to do with this since the log file in question is strictly Nginx SSL.