Issue Fail2ban

[Oliver Marugg]

Hi
Plesk 12.5.30-37 ubuntu14.04:

a. In fail2ban.log I have following error_:
fail2ban.filter [1506]: WARNING Error decoding line from '/var/log/mail.log' with 'ANSI_X3.4-1968'. Consider setting logencoding=utf-8 (or another appropriate encoding) for this jail. Continuing to process line ignoring invalid characters:

/etc/fail2ban/jails.local
added logencoding=utf-8
I've restarted fail2ban, but cant say if it works now. Because no new log entries are shown.

b. I tried to enter logencoding=utf-8 into fail2ban jail "plesk-dovecot". But no success.

Any ideas?

Many thanks,

oliver

 

[Pleskie]

I received the same message a few days ago. Seems like Fail2Ban can't read some characters in the log or something like that.

 

[UFHH01]

Hi Oliver Marugg,

consider to use inside the DEFAULT - section at "/etc/fail2ban/jail.conf" :

...
[DEFAULT]
...
# "logencoding" specifies the encoding of the log files handled by the jail
#   This is used to decode the lines from the log file.
#   Typical examples:  "ascii", "utf-8"
#
#   auto:   will use the system locale setting
# logencoding = auto
logencoding = utf-8
...

... to avoid entries in several jails, which are "normally" setup with UTF-8 - encoding in their corresponding service - configuration - files by default. Pls. check as well your "system locale settings" and always restart Fail2Ban, if you changed a standart setting.

 

[MMagnani]

consider to use inside the DEFAULT - section at "/etc/fail2ban/jail.conf" :

Would "/etc/fail2ban/jail.local" be a better choice?

 

[UFHH01]

Hi MMagnani,

you can certainly use as well "/etc/fail2ban/jail.local", to make sure, that no (automatic ) updates/upgrades/patches overwrite your setting.