Fail2ban high CPU usage

Support
1

Hi,

I have a problem with Fail2ban. The process is eating my CPU.

I had the problem with version 2.4 and I have upgraded to 2.5.4 but no changes.

Here is the content of my fail2ban.log

2017-02-07 21:37:10,458 fail2ban.server [1343]: INFO Stopping all jails
2017-02-07 21:37:11,237 fail2ban.jail [1343]: INFO Jail ‘nginx’ stopped
2017-02-07 21:37:12,002 fail2ban.jail [1343]: INFO Jail ‘sasl’ stopped
2017-02-07 21:37:12,248 fail2ban.jail [1343]: INFO Jail ‘pam-generic’ stopped
2017-02-07 21:37:12,904 fail2ban.jail [1343]: INFO Jail ‘dovecot’ stopped
2017-02-07 21:37:13,913 fail2ban.jail [1343]: INFO Jail ‘postfix’ stopped
2017-02-07 21:37:13,976 fail2ban.jail [1343]: INFO Jail ‘yunohost’ stopped
2017-02-07 21:37:14,031 fail2ban.jail [1343]: INFO Jail ‘ssh’ stopped
2017-02-07 21:37:14,033 fail2ban.server [1343]: ERROR Unable to remove PID file: [Errno 2] No such file or directory: '/var/run/fail2ban/fail2ban.pid’
2017-02-07 21:37:14,034 fail2ban.server [1343]: INFO Exiting Fail2ban
2017-02-07 21:37:17,249 fail2ban.server [14569]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.13
2017-02-07 21:37:17,254 fail2ban.jail [14569]: INFO Creating new jail 'ssh’
2017-02-07 21:37:17,357 fail2ban.jail [14569]: INFO Jail ‘ssh’ uses pyinotify
2017-02-07 21:37:17,476 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:17,481 fail2ban.filter [14569]: INFO Added logfile = /var/log/auth.log
2017-02-07 21:37:17,484 fail2ban.filter [14569]: INFO Set maxRetry = 6
2017-02-07 21:37:17,489 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:17,491 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:17,740 fail2ban.jail [14569]: INFO Creating new jail 'pam-generic’
2017-02-07 21:37:17,741 fail2ban.jail [14569]: INFO Jail ‘pam-generic’ uses pyinotify
2017-02-07 21:37:17,755 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:17,766 fail2ban.filter [14569]: INFO Added logfile = /var/log/auth.log
2017-02-07 21:37:17,769 fail2ban.filter [14569]: INFO Set maxRetry = 6
2017-02-07 21:37:17,774 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:17,776 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:17,815 fail2ban.jail [14569]: INFO Creating new jail 'postfix’
2017-02-07 21:37:17,815 fail2ban.jail [14569]: INFO Jail ‘postfix’ uses pyinotify
2017-02-07 21:37:17,838 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:17,842 fail2ban.filter [14569]: INFO Added logfile = /var/log/mail.log
2017-02-07 21:37:17,845 fail2ban.filter [14569]: INFO Set maxRetry = 3
2017-02-07 21:37:17,850 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:17,852 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:17,941 fail2ban.jail [14569]: INFO Creating new jail 'sasl’
2017-02-07 21:37:17,942 fail2ban.jail [14569]: INFO Jail ‘sasl’ uses pyinotify
2017-02-07 21:37:17,964 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:17,968 fail2ban.filter [14569]: INFO Added logfile = /var/log/mail.log
2017-02-07 21:37:17,971 fail2ban.filter [14569]: INFO Set maxRetry = 3
2017-02-07 21:37:17,975 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:17,977 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:18,026 fail2ban.jail [14569]: INFO Creating new jail 'dovecot’
2017-02-07 21:37:18,026 fail2ban.jail [14569]: INFO Jail ‘dovecot’ uses pyinotify
2017-02-07 21:37:18,041 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:18,056 fail2ban.filter [14569]: INFO Added logfile = /var/log/mail.log
2017-02-07 21:37:18,059 fail2ban.filter [14569]: INFO Set maxRetry = 3
2017-02-07 21:37:18,063 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:18,065 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:18,169 fail2ban.jail [14569]: INFO Creating new jail 'nginx’
2017-02-07 21:37:18,170 fail2ban.jail [14569]: INFO Jail ‘nginx’ uses pyinotify
2017-02-07 21:37:18,185 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:18,195 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/error.log
2017-02-07 21:37:18,200 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/search.wheek.me-error.log
2017-02-07 21:37:18,203 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/wheek.me-error.log
2017-02-07 21:37:18,206 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/wiki.wheek.me-error.log
2017-02-07 21:37:18,210 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/ozzmos.ddns.net-error.log
2017-02-07 21:37:18,213 fail2ban.filter [14569]: INFO Set maxRetry = 6
2017-02-07 21:37:18,221 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:18,226 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:18,399 fail2ban.jail [14569]: INFO Creating new jail 'yunohost’
2017-02-07 21:37:18,400 fail2ban.jail [14569]: INFO Jail ‘yunohost’ uses pyinotify
2017-02-07 21:37:18,421 fail2ban.jail [14569]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:37:18,425 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/error.log
2017-02-07 21:37:18,428 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/search.wheek.me-error.log
2017-02-07 21:37:18,432 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/wheek.me-error.log
2017-02-07 21:37:18,435 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/wiki.wheek.me-error.log
2017-02-07 21:37:18,446 fail2ban.filter [14569]: INFO Added logfile = /var/log/nginx/ozzmos.ddns.net-error.log
2017-02-07 21:37:18,449 fail2ban.filter [14569]: INFO Set maxRetry = 6
2017-02-07 21:37:18,454 fail2ban.filter [14569]: INFO Set findtime = 600
2017-02-07 21:37:18,456 fail2ban.actions[14569]: INFO Set banTime = 600
2017-02-07 21:37:18,491 fail2ban.jail [14569]: INFO Jail ‘ssh’ started
2017-02-07 21:37:18,511 fail2ban.jail [14569]: INFO Jail ‘pam-generic’ started
2017-02-07 21:37:18,535 fail2ban.filter [14569]: ERROR Error in FilterPyinotify callback: ‘module’ object has no attribute '_strptime_time’
2017-02-07 21:37:18,537 fail2ban.jail [14569]: INFO Jail ‘postfix’ started
2017-02-07 21:37:18,570 fail2ban.jail [14569]: INFO Jail ‘sasl’ started
2017-02-07 21:37:18,579 fail2ban.jail [14569]: INFO Jail ‘dovecot’ started
2017-02-07 21:37:18,616 fail2ban.jail [14569]: INFO Jail ‘nginx’ started
2017-02-07 21:37:18,634 fail2ban.jail [14569]: INFO Jail ‘yunohost’ started
2017-02-07 21:49:14,611 fail2ban.server [14569]: INFO Stopping all jails
2017-02-07 21:49:15,333 fail2ban.jail [14569]: INFO Jail ‘nginx’ stopped
2017-02-07 21:49:16,265 fail2ban.jail [14569]: INFO Jail ‘sasl’ stopped
2017-02-07 21:49:17,166 fail2ban.jail [14569]: INFO Jail ‘pam-generic’ stopped
2017-02-07 21:49:17,377 fail2ban.jail [14569]: INFO Jail ‘dovecot’ stopped
2017-02-07 21:49:18,103 fail2ban.jail [14569]: INFO Jail ‘postfix’ stopped
2017-02-07 21:49:18,524 fail2ban.jail [14569]: INFO Jail ‘yunohost’ stopped
2017-02-07 21:49:19,008 fail2ban.jail [14569]: INFO Jail ‘ssh’ stopped
2017-02-07 21:49:19,009 fail2ban.server [14569]: INFO Exiting Fail2ban
2017-02-07 21:49:56,288 fail2ban.server [17716]: INFO Changed logging target to /var/log/fail2ban.log for Fail2ban v0.8.13
2017-02-07 21:49:56,292 fail2ban.jail [17716]: INFO Creating new jail 'ssh’
2017-02-07 21:49:56,386 fail2ban.jail [17716]: INFO Jail ‘ssh’ uses pyinotify
2017-02-07 21:49:56,482 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:56,486 fail2ban.filter [17716]: INFO Added logfile = /var/log/auth.log
2017-02-07 21:49:56,496 fail2ban.filter [17716]: INFO Set maxRetry = 6
2017-02-07 21:49:56,501 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:56,503 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:56,728 fail2ban.jail [17716]: INFO Creating new jail 'pam-generic’
2017-02-07 21:49:56,729 fail2ban.jail [17716]: INFO Jail ‘pam-generic’ uses pyinotify
2017-02-07 21:49:56,745 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:56,752 fail2ban.filter [17716]: INFO Added logfile = /var/log/auth.log
2017-02-07 21:49:56,756 fail2ban.filter [17716]: INFO Set maxRetry = 6
2017-02-07 21:49:56,760 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:56,762 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:56,802 fail2ban.jail [17716]: INFO Creating new jail 'postfix’
2017-02-07 21:49:56,802 fail2ban.jail [17716]: INFO Jail ‘postfix’ uses pyinotify
2017-02-07 21:49:56,822 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:56,826 fail2ban.filter [17716]: INFO Added logfile = /var/log/mail.log
2017-02-07 21:49:56,829 fail2ban.filter [17716]: INFO Set maxRetry = 3
2017-02-07 21:49:56,834 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:56,836 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:56,920 fail2ban.jail [17716]: INFO Creating new jail 'sasl’
2017-02-07 21:49:56,920 fail2ban.jail [17716]: INFO Jail ‘sasl’ uses pyinotify
2017-02-07 21:49:56,937 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:56,946 fail2ban.filter [17716]: INFO Added logfile = /var/log/mail.log
2017-02-07 21:49:56,952 fail2ban.filter [17716]: INFO Set maxRetry = 3
2017-02-07 21:49:56,956 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:56,958 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:56,994 fail2ban.jail [17716]: INFO Creating new jail 'dovecot’
2017-02-07 21:49:56,994 fail2ban.jail [17716]: INFO Jail ‘dovecot’ uses pyinotify
2017-02-07 21:49:57,012 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:57,018 fail2ban.filter [17716]: INFO Added logfile = /var/log/mail.log
2017-02-07 21:49:57,021 fail2ban.filter [17716]: INFO Set maxRetry = 3
2017-02-07 21:49:57,026 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:57,027 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:57,120 fail2ban.jail [17716]: INFO Creating new jail 'nginx’
2017-02-07 21:49:57,120 fail2ban.jail [17716]: INFO Jail ‘nginx’ uses pyinotify
2017-02-07 21:49:57,141 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:57,145 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/error.log
2017-02-07 21:49:57,149 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/search.wheek.me-error.log
2017-02-07 21:49:57,151 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/wheek.me-error.log
2017-02-07 21:49:57,154 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/wiki.wheek.me-error.log
2017-02-07 21:49:57,158 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/ozzmos.ddns.net-error.log
2017-02-07 21:49:57,163 fail2ban.filter [17716]: INFO Set maxRetry = 6
2017-02-07 21:49:57,171 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:57,173 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:57,338 fail2ban.jail [17716]: INFO Creating new jail 'yunohost’
2017-02-07 21:49:57,338 fail2ban.jail [17716]: INFO Jail ‘yunohost’ uses pyinotify
2017-02-07 21:49:57,359 fail2ban.jail [17716]: INFO Initiated ‘pyinotify’ backend
2017-02-07 21:49:57,363 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/error.log
2017-02-07 21:49:57,367 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/search.wheek.me-error.log
2017-02-07 21:49:57,370 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/wheek.me-error.log
2017-02-07 21:49:57,375 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/wiki.wheek.me-error.log
2017-02-07 21:49:57,380 fail2ban.filter [17716]: INFO Added logfile = /var/log/nginx/ozzmos.ddns.net-error.log
2017-02-07 21:49:57,384 fail2ban.filter [17716]: INFO Set maxRetry = 6
2017-02-07 21:49:57,388 fail2ban.filter [17716]: INFO Set findtime = 600
2017-02-07 21:49:57,390 fail2ban.actions[17716]: INFO Set banTime = 600
2017-02-07 21:49:57,425 fail2ban.jail [17716]: INFO Jail ‘ssh’ started
2017-02-07 21:49:57,481 fail2ban.jail [17716]: INFO Jail ‘pam-generic’ started
2017-02-07 21:49:57,533 fail2ban.jail [17716]: INFO Jail ‘postfix’ started
2017-02-07 21:49:57,579 fail2ban.jail [17716]: INFO Jail ‘sasl’ started
2017-02-07 21:49:57,608 fail2ban.jail [17716]: INFO Jail ‘dovecot’ started
2017-02-07 21:49:57,656 fail2ban.jail [17716]: INFO Jail ‘nginx’ started
2017-02-07 21:49:57,702 fail2ban.jail [17716]: INFO Jail ‘yunohost’ started

1 Like
2

For information, I resolved the problem. The auth.log file was really huge and failban read it to ban ip.
I had to tweak logrotate:

/var/log/auth.log {
missingok
daily
notifempty
compress
rotate 7
size 10M
}

3 Likes
3

Hi @ozzmos and thanks for sharing: I just ran into the same issue, it even made the server unresponsive. I managed to fix my server with your trick. I had to first install logrotate (though I’m using a debian 8 server. Weird!) and force-run it.

4

My CPU usage dropped from 100% to 3%. Thanks buddy!

Location of logrotate is /etc/logrotate.conf

You want to paste Ozzmos’ code at the bottom of the file:

/var/log/auth.log {
   missingok
   daily
   notifempty
   compress
   rotate 7
   size 10M
}
5

Hi, I’m facing the same issue and as I am not an IT person I have no idea how to arrive at /etc/logrotate.conf to add the code. If someone can give me any direction that would be much appreciated.

6

Hello Dear

I am facing the same issue at the moment. i have applied @ozzmos lines but still having same issue. See screenshot

Kindly assist on resolution

image
image.png1826×72 6.78 KB