fail2ban / How to correctly setup Log file?

[Loader23]

Hi,
i want include Radicale log files in fail2ban but don't know how to set it up.
I have this log conf:

[loggers]
keys = root

[handlers]
keys = file

[formatters]
keys = full

[logger_root]
level = INFO
handlers = file

[handler_file]
class = handlers.RotatingFileHandler
args = ('/log/radicale.log', 'a', 100000, 3)
formatter = full

[formatter_full]
format = %(asctime)s - [%(thread)x] %(levelname)s: %(message)s

But the logfiles get spammed with this:
2019-01-08 21:57:36,717 - [7fe02e170ae8] INFO: GET request for '/' received from 127.0.0.1 using 'curl/7.61.1' 2019-01-08 21:57:36,719 - [7fe02e170ae8] INFO: GET response status for '/' in 0.002 seconds: 302 Found 2019-01-08 21:58:06,846 - [7fe02e170ae8] INFO: GET request for '/' received from 127.0.0.1 using 'curl/7.61.1' 2019-01-08 21:58:06,849 - [7fe02e170ae8] INFO: GET response status for '/' in 0.003 seconds: 302 Found 2019-01-08 21:58:36,976 - [7fe02e170ae8] INFO: GET request for '/' received from 127.0.0.1 using 'curl/7.61.1' 2019-01-08 21:58:36,978 - [7fe02e170ae8] INFO: GET response status for '/' in 0.002 seconds: 302 Found 2019-01-08 21:59:07,104 - [7fe02e170ae8] INFO: GET request for '/' received from 127.0.0.1 using 'curl/7.61.1' 2019-01-08 21:59:07,106 - [7fe02e170ae8] INFO: GET response status for '/' in 0.002 seconds: 302 Found

How do I set it up so that it only logs the relevant things?

[kimpenhaus]

Not sure what the relevant things are that you want to log, but have you tried configuring different level than INFO?

From the python docs - possible values are:

The level entry can be one of DEBUG, INFO, WARNING, ERROR, CRITICAL or NOTSET. For the root logger only, NOTSET means that all messages will be logged. Level values are eval()uated in the context of the logging package’s namespace.

I would suggest setting it to WARNING or ERROR to decrease the amount of log entries you'll see.

[Loader23]

I need to log the IP of the requester like it is mentioned here: #547
So Info seems to be right but without this other stuff above.

[mookie-]

@Loader23 Which part of the stuff above do you not want? It seems like there is something doing something like curl localhost:5232 on your machine any 30 seconds and theses are the logs which get generated.

[kimpenhaus]

I assume it's running inside a docker container (maybe this one: docker-radicale). The curl command is doing a health check (HEALTHCHECK --interval=30s --retries=3 CMD curl --fail http://localhost:5232 || exit 1) and the command could be disabled during run (--no-healthcheck) - see docker-reference.

[dholl]

Hello, I've run into the same issue while attempting to use fail2ban to monitor radicale's log. I'm using Radicale 2.1.11, and set log level to INFO. However, the log messages produced for failed attempts do not include the source IP address.

Specifically in __init__.py, I found:

if not is_authenticated:
    self.logger.info("Failed login attempt: %r", user)

Could we change this to include remote_host and maybe raise the log level of this message?

Specifically, I'd like this:

if not is_authenticated:
    self.logger.warning("Failed login attempt from %s : %r", remote_host, user)

If I could be picky, I wish Python's logging module included a "notice" level like syslog, that was between the "info" and "warning" levels, so then I could raise my log level to just "notice" and skip the numerous "info" messages... But I'll be happy with any sort of remote IP logging for failed authentications.

Thank you,
David

[pbiering]

fail2ban examples for current 3.x versions were updated now: https://github.com/Kozea/Radicale/wiki/Fail2Ban-Setup