#620364 fail2ban: Fail2ban doesn't cope with "last message repeated 50 times"

Package:
fail2ban
Source:
fail2ban
Submitter:
Helge Hafting
Date:
2026-09-07 15:37:03 UTC
Severity:
wishlist
#620364#5
Date:
2011-04-01 13:17:57 UTC
From:
To:
*** Please type your report below this line ***

Fail2ban counts entries in various logs, but does not react when it gets

last message repeated x times

Discovered when a student tested fail2ban, and it did not ban him
despite many wrong passwords. Syslog logged only the first attempt,
and then resorted to "last message repeated x times"

Ideal fix: have fail2ban understand "last message repeated" and add up
the numbers.

Minimal fix: Document that the user may want to turn off such line
compression. Some recent versions of syslog can do that. But fixing
fail2ban would be better. log compression is useful, and a
program that calls itself a "log parser" ought to understand.

Helge Hafting
#620364#12
Date:
2011-04-02 17:35:33 UTC
From:
To:
severity 620364 wishlist
thanks

indeed

See
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=440037
for previous report and the "resolution".

I will try to not forget to provide documentation for the next upload
and I will leave this bug open just in case someone decides to
report it again, and may be comes up with a patch on how to provide
built-in capability to handle those.

Cheers,