| 1 | plugin_name: go.d.plugin |
| 2 | modules: |
| 3 | - meta: |
| 4 | id: collector-go.d.plugin-fail2ban |
| 5 | plugin_name: go.d.plugin |
| 6 | module_name: fail2ban |
| 7 | monitored_instance: |
| 8 | name: Fail2ban |
| 9 | link: "https://github.com/fail2ban/fail2ban#readme" |
| 10 | icon_filename: fail2ban.png |
| 11 | categories: |
| 12 | - data-collection.applications |
| 13 | keywords: |
| 14 | - fail2ban |
| 15 | - security |
| 16 | - authentication |
| 17 | - authorization |
| 18 | related_resources: |
| 19 | integrations: |
| 20 | list: [] |
| 21 | info_provided_to_referring_integrations: |
| 22 | description: "" |
| 23 | overview: |
| 24 | data_collection: |
| 25 | metrics_description: > |
| 26 | This collector tracks two main metrics for each jail: currently banned IPs and active failure incidents. |
| 27 | It relies on the [`fail2ban-client`](https://linux.die.net/man/1/fail2ban-client) CLI tool but avoids directly executing the binary. |
| 28 | Instead, it utilizes `ndsudo`, a Netdata helper specifically designed to run privileged commands securely within the Netdata environment. |
| 29 | This approach eliminates the need to use `sudo`, improving security and potentially simplifying permission management. |
| 30 | method_description: "" |
| 31 | supported_platforms: |
| 32 | include: [Linux] |
| 33 | exclude: [] |
| 34 | multi_instance: false |
| 35 | additional_permissions: |
| 36 | description: "" |
| 37 | default_behavior: |
| 38 | auto_detection: |
| 39 | description: "" |
| 40 | limits: |
| 41 | description: "" |
| 42 | performance_impact: |
| 43 | description: "" |
| 44 | setup: |
| 45 | prerequisites: |
| 46 | list: |
| 47 | - title: For Netdata running in a Docker container |
| 48 | description: | |
| 49 | 1. **Install Fail2ban client**. |
| 50 | |
| 51 | Ensure `fail2ban-client` is available in the container by setting the environment variable `NETDATA_EXTRA_DEB_PACKAGES=fail2ban` when starting the container. |
| 52 | |
| 53 | 2. **Mount host's `/var/run` directory**. |
| 54 | |
| 55 | Mount the host machine's `/var/run` directory to `/host/var/run` inside your Netdata container. This grants Netdata access to the Fail2ban socket file, typically located at `/var/run/fail2ban/fail2ban.sock`. |
| 56 | configuration: |
| 57 | file: |
| 58 | name: go.d/fail2ban.conf |
| 59 | options: |
| 60 | description: | |
| 61 | The following options can be defined globally: update_every. |
| 62 | folding: |
| 63 | title: Config options |
| 64 | enabled: true |
| 65 | list: |
| 66 | - name: update_every |
| 67 | description: Data collection frequency. |
| 68 | default_value: 10 |
| 69 | required: false |
| 70 | - name: timeout |
| 71 | description: fail2ban-client binary execution timeout. |
| 72 | default_value: 2 |
| 73 | required: false |
| 74 | examples: |
| 75 | folding: |
| 76 | title: Config |
| 77 | enabled: true |
| 78 | list: |
| 79 | - name: Custom update_every |
| 80 | description: Allows you to override the default data collection interval. |
| 81 | config: | |
| 82 | jobs: |
| 83 | - name: fail2ban |
| 84 | update_every: 5 # Collect Fail2Ban jails statistics every 5 seconds |
| 85 | troubleshooting: |
| 86 | problems: |
| 87 | list: [] |
| 88 | alerts: [] |
| 89 | metrics: |
| 90 | folding: |
| 91 | title: Metrics |
| 92 | enabled: false |
| 93 | description: "" |
| 94 | availability: [] |
| 95 | scopes: |
| 96 | - name: jail |
| 97 | description: These metrics refer to the Jail. |
| 98 | labels: |
| 99 | - name: jail |
| 100 | description: Jail's name |
| 101 | metrics: |
| 102 | - name: fail2ban.jail_banned_ips |
| 103 | description: Fail2Ban Jail banned IPs |
| 104 | unit: addresses |
| 105 | chart_type: line |
| 106 | dimensions: |
| 107 | - name: banned |
| 108 | - name: fail2ban.jail_active_failures |
| 109 | description: Fail2Ban Jail active failures |
| 110 | unit: failures |
| 111 | chart_type: line |
| 112 | dimensions: |
| 113 | - name: active_failures |