dom

telegraf

History

Daniel Nelson ae1611aecc Update fail2ban documentation		2017-08-25 11:42:07 -07:00
..
README.md	Update fail2ban documentation	2017-08-25 11:42:07 -07:00
fail2ban.go	Update fail2ban documentation	2017-08-25 11:42:07 -07:00
fail2ban_test.go	Add input plugin for Fail2ban (#2875 )	2017-06-21 12:42:13 -07:00

README.md

Fail2ban Input Plugin

The fail2ban plugin gathers the count of failed and banned ip addresses using fail2ban.

This plugin runs the fail2ban-client command which generally requires root access. Acquiring the required permissions can be done using several methods:

Use sudo run fail2ban-client.
Run telegraf as root. (not recommended)

Using sudo

You may edit your sudo configuration with the following:

telegraf ALL=(root) NOEXEC: NOPASSWD: /usr/bin/fail2ban-client status, /usr/bin/fail2ban-client status *

Configuration:

# Read metrics from fail2ban.
[[inputs.fail2ban]]
  ## Use sudo to run fail2ban-client
  use_sudo = false

Measurements & Fields:

fail2ban
- failed (integer, count)
- banned (integer, count)

Example Output:

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 5
|  |- Total failed:     20
|  `- File list:        /var/log/secure
`- Actions
   |- Currently banned: 2
   |- Total banned:     10
   `- Banned IP list:   192.168.0.1 192.168.0.2

fail2ban,jail=sshd failed=5i,banned=2i 1495868667000000000