{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/2208","repository_url":"https://api.github.com/repos/fail2ban/fail2ban","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/2208/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/2208/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/2208/events","html_url":"https://github.com/fail2ban/fail2ban/issues/2208","id":354351608,"node_id":"MDU6SXNzdWUzNTQzNTE2MDg=","number":2208,"title":"using variations of jails causes 'Too many open files' errors","user":{"login":"RobbieTheK","id":21204619,"node_id":"MDQ6VXNlcjIxMjA0NjE5","avatar_url":"https://avatars2.githubusercontent.com/u/21204619?v=4","gravatar_id":"","url":"https://api.github.com/users/RobbieTheK","html_url":"https://github.com/RobbieTheK","followers_url":"https://api.github.com/users/RobbieTheK/followers","following_url":"https://api.github.com/users/RobbieTheK/following{/other_user}","gists_url":"https://api.github.com/users/RobbieTheK/gists{/gist_id}","starred_url":"https://api.github.com/users/RobbieTheK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RobbieTheK/subscriptions","organizations_url":"https://api.github.com/users/RobbieTheK/orgs","repos_url":"https://api.github.com/users/RobbieTheK/repos","events_url":"https://api.github.com/users/RobbieTheK/events{/privacy}","received_events_url":"https://api.github.com/users/RobbieTheK/received_events","type":"User","site_admin":false},"labels":[{"id":33647713,"node_id":"MDU6TGFiZWwzMzY0NzcxMw==","url":"https://api.github.com/repos/fail2ban/fail2ban/labels/3rd%20party%20%20issue","name":"3rd party  issue","color":"e102d8","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":19,"created_at":"2018-08-27T14:51:08Z","updated_at":"2018-09-01T17:30:04Z","closed_at":"2018-08-29T13:53:17Z","author_association":"NONE","body":"### Environment:\r\n- Fail2Ban version (including any possible distribution suffixes): fail2ban-0.10.3.1-2\r\n- OS, including release name/version: Fedora 28\r\n- [X] Fail2Ban installed via OS/distribution mechanisms\r\n\r\n### The issue:\r\n\r\nWhen using variations of a jail, e.g., sendmail-auth and httpd-forbidden-1, errors such as \r\n**Received OSError('Cannot initialize new instance of inotify, Errno=Too many open files (EM\r\nFILE)',)** appear\r\n\r\nrelavant jail.local config:\r\n\r\n```\r\n[sendmail-auth]\r\nenabled  = false\r\nfilter   = sendmail-auth\r\naction   = iptables-allports[name=sendmail-auth,port=\"smtp,smtps\", protocol=tcp]\r\n           sendmail-whois[name=sendmail-auth, dest=root, sender=fail2ban, sendername=\"Fail2Ban\"]\r\nlogpath  = /var/log/maillog\r\nmaxretry = 4\r\n\r\n[sendmail-auth2]\r\nenabled  = false\r\nfilter   = sendmail-auth2\r\naction   = iptables-allports[name=sendmail-auth,port=\"smtp,smtps\", protocol=tcp]\r\nlogpath  = /var/log/maillog\r\nmaxretry = 4\r\n\r\n[httpd-forbidden-1]\r\nenabled = false\r\nfilter = httpd-forbidden\r\nlogpath  = /usr/local/etc/httpd/logs/*access_log\r\nbantime = 3600\r\nmaxretry = 6\r\n#findtime = 1800\r\nport = 80,443\r\n\r\n[httpd-forbidden-2]\r\nenabled = false\r\nfilter = httpd-forbidden\r\nlogpath  = /usr/local/etc/httpd/logs/*error_log\r\nbantime = 3600\r\nmaxretry = 6\r\n#findtime = 1800\r\nport = 80,443\r\n```\r\n\r\n#### Steps to reproduce\r\nEnable multiple jails with slight differences or different path to a different log file.\r\n\r\n#### Observed behavior\r\nToo many open files errors, spams fail2ban.log file incessantly.\r\n\r\n### Configuration, dump and another helpful excerpts\r\n```\r\ncat /etc/fail2ban/filter.d/sendmail-auth.conf \r\n\r\nFail2Ban filter for sendmail authentication failures\r\n\r\n[INCLUDES]\r\n\r\nbefore = common.conf\r\n\r\n[Definition]\r\n\r\n_daemon = (?:sendmail|sm-(?:mta|acceptingconnections))\r\n\r\nfailregex = ^%(__prefix_line)s\\w{14}: (\\S+ )?\\[(?:IPv6:<IP6>|<IP4>)\\]( \\(may be forged\\))?: possible SMTP attack: command=AUTH, count=\\d+$\r\n\r\nignoreregex =\r\n\r\njournalmatch = _SYSTEMD_UNIT=sendmail.service\r\n\r\nDEV Notes:\r\nAuthor: Daniel Black\r\n\r\n#### Any customizations done to /etc/fail2ban/ configuration\r\n\r\n[INCLUDES]\r\n\r\nbefore = common.conf\r\n\r\n[Definition]\r\n\r\n_daemon = (?:sendmail|sm-(?:mta|acceptingconnections))\r\n\r\nfailregex = ^%(__prefix_line)s\\w{14}: (\\S+ )?\\[(?:IPv6:<IP6>|<IP4>)\\]( \\(may be forged\\))?: possible SMTP attack: command=AUTH, count=\\d+$\r\n\r\nignoreregex =\r\n\r\njournalmatch = _SYSTEMD_UNIT=sendmail.service\r\n\r\ncat /etc/fail2ban/filter.d/sendmail-auth2.local \r\n\r\n[INCLUDES]\r\n\r\nbefore = common.conf\r\n\r\n[Definition]\r\n\r\n_daemon = (?:sendmail|sm-(?:mta|acceptingconnections))\r\n\r\n#failregex = ^%(__prefix_line)s\\w{14}: (\\S+ )?\\[<HOST>\\]( \\(may be forged\\))?: possible SMTP attack: command=AUTH, count=\\d+$\r\n#https://www.autonarcosis.com/2015/10/14/fail2ban-sendmail-auth-howto/\r\nfailregex = \\[<HOST>\\] .*to MTA\r\n            \\[<HOST>\\] \\(may be forged\\)\r\n            \\[<HOST>\\], reject.*\\.\\.\\. Relaying denied\r\n\r\nignoreregex =\r\n\r\n[Init]\r\n\r\njournalmatch = _SYSTEMD_UNIT=sendmail.service\r\n```\r\n#### Relevant parts of /var/log/fail2ban.log file:\r\n\r\n```\r\n2018-08-27 09:05:48,868 fail2ban.jail           [14750]: INFO    Creating new jail 'httpd-forbidden-1'\r\n2018-08-27 09:05:48,868 fail2ban.jail           [14750]: INFO    Jail 'httpd-forbidden-1' uses pyinotify {}\r\n2018-08-27 09:05:48,869 fail2ban.transmitter    [14750]: WARNING Command ['add', 'httpd-forbidden-1', 'auto'] has failed. Received OSError('Cannot initialize new instance of inotify, Errno=Too many open files (EMFILE)',)\r\n2018-08-27 09:05:48,869 fail2ban                [14750]: ERROR   NOK: ('Cannot initialize new instance of inotify, Errno=Too many open files (EMFILE)',)\r\n2018-08-27 09:05:48,870 fail2ban.transmitter    [14750]: WARNING Command ['multi-set', 'httpd-forbidden-1', 'addfailregex', ['<HOST>\\\\ \\\\-\\\\ \\\\-\\\\ .*HTTP\\\\/[0-9]+(\\\\.[0-9]+)?\\\\\" 403', '\\\\[client\\\\ <HOST>\\\\]\\\\ AH0\r\n1797\\\\:\\\\ client\\\\ denied']] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,870 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,870 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addlogpath', '/usr/local/etc/httpd/logs/access_log', 'head'] has failed. Received UnknownJailException('httpd\r\n-forbidden-1',)\r\n2018-08-27 09:05:48,871 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,871 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'findtime', '10m'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,871 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,872 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'bantime', '3600'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,872 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,872 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'usedns', 'warn'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,872 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,872 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'ignorecommand', ''] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,873 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,873 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '127.0.0.1'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,873 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,873 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '192.168.1.0/24'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,874 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,874 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '150.108.68.0/24'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,874 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,874 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '10.0.10.0/24'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,874 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,875 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '192.168.122.0/24'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,875 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,875 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '150.108.64.0/24'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,875 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,875 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '150.108.4.0/24'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,876 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,876 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '172.21.0.0/12'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,876 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,876 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '10.88.0.0/12'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,876 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,877 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '10.100.0.0/12'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,877 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,877 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addignoreip', '10.216.0.0/12'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,877 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,878 fail2ban.transmitter    [14750]: WARNING Command ['set', 'httpd-forbidden-1', 'addaction', 'iptables-multiport'] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,878 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,878 fail2ban.transmitter    [14750]: WARNING Command ['multi-set', 'httpd-forbidden-1', 'action', 'iptables-multiport', [['actionstart', '<iptables> -N f2b-httpd-forbidden-1\\n<iptables> -A f2b-httpd-forbidden-1 -j RETURN\\n<iptables> -I INPUT -p tcp -m multiport --dports 80,443 -j f2b-httpd-forbidden-1'], ['actionstop', '<iptables> -D INPUT -p tcp -m multiport --dports 80,443 -j f2b-httpd-forbidden-1\\n<iptables> -F f2b-httpd-forbidden-1\\n<iptables> -X f2b-httpd-forbidden-1'], ['actionflush', '<iptables> -F f2b-httpd-forbidden-1'], ['actioncheck', \"<iptables> -n -L INPUT | grep -q 'f2b-httpd-forbidden-1[ \\\\t]'\"], ['actionban', '<iptables> -I f2b-httpd-forbidden-1 1 -s <ip> -j <blocktype>'], ['actionunban', '<iptables> -D f2b-httpd-forbidden-1 -s <ip> -j <blocktype>'], ['name', 'httpd-forbidden-1'], ['bantime', '3600'], ['port', '80,443'], ['protocol', 'tcp'], ['chain', '<known/chain>'], ['actname', 'iptables-multiport'], ['blocktype', 'REJECT --reject-with icmp-port-unreachable'], ['returntype', 'RETURN'], ['lockingopt', '-w'], ['iptables', 'iptables <lockingopt>'], ['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'], ['iptables?family=inet6', 'ip6tables <lockingopt>']]] has failed. Received UnknownJailException('httpd-forbidden-1',)\r\n2018-08-27 09:05:48,878 fail2ban                [14750]: ERROR   NOK: ('httpd-forbidden-1',)\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/417874997","html_url":"https://github.com/fail2ban/fail2ban/issues/2208#issuecomment-417874997","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/2208","id":417874997,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNzg3NDk5Nw==","user":{"login":"RobbieTheK","id":21204619,"node_id":"MDQ6VXNlcjIxMjA0NjE5","avatar_url":"https://avatars2.githubusercontent.com/u/21204619?v=4","gravatar_id":"","url":"https://api.github.com/users/RobbieTheK","html_url":"https://github.com/RobbieTheK","followers_url":"https://api.github.com/users/RobbieTheK/followers","following_url":"https://api.github.com/users/RobbieTheK/following{/other_user}","gists_url":"https://api.github.com/users/RobbieTheK/gists{/gist_id}","starred_url":"https://api.github.com/users/RobbieTheK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RobbieTheK/subscriptions","organizations_url":"https://api.github.com/users/RobbieTheK/orgs","repos_url":"https://api.github.com/users/RobbieTheK/repos","events_url":"https://api.github.com/users/RobbieTheK/events{/privacy}","received_events_url":"https://api.github.com/users/RobbieTheK/received_events","type":"User","site_admin":false},"created_at":"2018-09-01T17:30:04Z","updated_at":"2018-09-01T17:30:04Z","author_association":"NONE","body":"Some interesting warnings I have to check:\r\nfail2ban-client -d | grep -E \"'systemd|'addjournalmatch'\"\r\nbash: +: command not found...\r\n[rkudyba@storm ~]$ fail2ban-client -d | grep -E \"'systemd|'addjournalmatch'\" 2018-09-01 13:27:52,483 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*error_log\r\n2018-09-01 13:27:52,483 fail2ban.jailreader     [6114]: WARNING Have not found any log file for apache-auth jail\r\n2018-09-01 13:27:52,484 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*access_log\r\n2018-09-01 13:27:52,484 fail2ban.jailreader     [6114]: WARNING Have not found any log file for apache-badbots jail\r\n2018-09-01 13:27:52,485 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*error_log\r\n2018-09-01 13:27:52,485 fail2ban.jailreader     [6114]: WARNING Have not found any log file for apache-noscript jail\r\n2018-09-01 13:27:52,486 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*error_log\r\n2018-09-01 13:27:52,486 fail2ban.jailreader     [6114]: WARNING Have not found any log file for apache-overflows jail\r\n2018-09-01 13:27:52,486 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*error_log\r\n2018-09-01 13:27:52,487 fail2ban.jailreader     [6114]: WARNING Have not found any log file for apache-nohome jail\r\n2018-09-01 13:27:52,487 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*access_log\r\n2018-09-01 13:27:52,487 fail2ban.jailreader     [6114]: WARNING Have not found any log file for apache-fakegooglebot jail\r\n2018-09-01 13:27:52,491 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*error_log\r\n2018-09-01 13:27:52,491 fail2ban.jailreader     [6114]: ERROR   No file(s) found for glob /var/log/httpd/*access_log\r\n2018-09-01 13:27:52,491 fail2ban.jailreader     [6114]: WARNING Have not found any log file for httpd-forbidden jail\r\n['set', 'sshd', 'addjournalmatch', '_SYSTEMD_UNIT=sshd.service', '+', '_COMM=sshd']\r\n['add', 'sendmail-auth', 'systemd']\r\n['set', 'sendmail-auth', 'addjournalmatch', '_SYSTEMD_UNIT=sendmail.service']['add', 'dovecot', 'systemd']\r\n['set', 'dovecot', 'addjournalmatch', '_SYSTEMD_UNIT=dovecot.service']\r\n['add', 'recidive', 'systemd[journalfiles=\"/var/log/journal/02821bb2ccde4f86a19574027996b785/system.journal\"]']\r\n['set', 'recidive', 'addjournalmatch', '_SYSTEMD_UNIT=fail2ban.service', 'PRIORITY=5']\r\n['add', 'pam-generic', 'systemd']"}}
{"actor":{"display_login":"RobbieTheK"}}