我想使用 fail2ban 来保护我的服务器。http 服务器是一个脚本节点，我成功格式化了日志，如下所示：
2017-03-18 18:03:32.940 [ INFO ] - ::ffff:192.168.1.56 GET /
jail.conf 的有趣部分是：
[node-get-dos]
enabled = true
port = 8080
filter = node-get-dos
logpath = /logs/selector.log
maxretry = 10
findtime = 10
bantime = 600
node-get-dos 的内容为：
[Definition]
failregex = \[.*\].*:.?:.*:<HOST>.*\ (GET|POST|DELETE).*
ignoreregex =
因此，当我启动以下命令时，我不会被禁止：
ab -n 1000 -c 100 http://192.168.1.3:8080/
我不知道这是否重要，但是节点脚本位于 docker 容器中。
我已经有一个解决方案，就是将节点放在反向代理（apache）后面，并配置fail2ban来分析apache的日志（access.log），但我想避免这样做（消耗更多的CPU和RAM）。
编辑：这是重新启动并启动 ab 命令后的示例：
2017-03-18 19:25:52,296 fail2ban.server [15690]: INFO Exiting Fail2ban
2017-03-18 19:25:52,584 fail2ban.server [21170]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.3
2017-03-18 19:25:52,586 fail2ban.database [21170]: INFO Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2017-03-18 19:25:52,591 fail2ban.jail [21170]: INFO Creating new jail 'sshd'
2017-03-18 19:25:52,606 fail2ban.jail [21170]: INFO Jail 'sshd' uses pyinotify
2017-03-18 19:25:52,617 fail2ban.filter [21170]: INFO Set jail log file encoding to UTF-8
2017-03-18 19:25:52,622 fail2ban.jail [21170]: INFO Initiated 'pyinotify' backend
2017-03-18 19:25:52,626 fail2ban.filter [21170]: INFO Set maxRetry = 3
2017-03-18 19:25:52,627 fail2ban.actions [21170]: INFO Set banTime = 900
2017-03-18 19:25:52,630 fail2ban.filter [21170]: INFO Added logfile = /var/log/auth.log
2017-03-18 19:25:52,633 fail2ban.filter [21170]: INFO Set findtime = 600
2017-03-18 19:25:52,633 fail2ban.filter [21170]: INFO Set jail log file encoding to UTF-8
2017-03-18 19:25:52,634 fail2ban.filter [21170]: INFO Set maxlines = 10
2017-03-18 19:25:52,691 fail2ban.server [21170]: INFO Jail sshd is not a JournalFilter instance
2017-03-18 19:25:52,695 fail2ban.jail [21170]: INFO Creating new jail 'node-get-dos'
2017-03-18 19:25:52,695 fail2ban.jail [21170]: INFO Jail 'node-get-dos' uses pyinotify
2017-03-18 19:25:52,696 fail2ban.filter [21170]: INFO Set jail log file encoding to UTF-8
2017-03-18 19:25:52,699 fail2ban.jail [21170]: INFO Initiated 'pyinotify' backend
2017-03-18 19:25:52,703 fail2ban.filter [21170]: INFO Set maxRetry = 10
2017-03-18 19:25:52,703 fail2ban.actions [21170]: INFO Set banTime = 600
2017-03-18 19:25:52,706 fail2ban.filter [21170]: INFO Added logfile = /logs/selector.log
2017-03-18 19:25:52,710 fail2ban.filter [21170]: INFO Set findtime = 10
2017-03-18 19:25:52,710 fail2ban.filter [21170]: INFO Set jail log file encoding to UTF-8
2017-03-18 19:25:52,718 fail2ban.jail [21170]: INFO Jail 'sshd' started
2017-03-18 19:25:52,724 fail2ban.jail [21170]: INFO Jail 'node-get-dos' started
答案1
fail2ban-regex 实用程序表示您的正则表达式很好，并且与您提供的日志相匹配
Lines: 1 lines, 0 ignored, 1 matched, 0 missed
所以你需要去别处看看。你应该检查 fail2ban 启动时的日志消息，以确保它可以读取日志文件。我不知道你会在你拥有的 frankenstack 的哪里找到它们。