go.d fail2ban: add docker support (#18081)
Ilya Mashchenko committed
Jul 8, 2024 at 13:29 UTC
d9177e2bcf0f3a97b0841a8a64b76986c21619ba
3 files changed
+52
-7
src/collectors/plugins.d/ndsudo.c
+16
@@ -61,6 +61,14 @@ struct command {
61
[1] = NULL,
62
},
63
},
64
+ {
65
+ .name = "fail2ban-client-status-socket",
66
+ .params = "-s {{socket_path}} status",
67
+ .search = {
68
+ [0] = "fail2ban-client",
69
+ [1] = NULL,
70
+ },
71
+ },
72
{
73
.name = "fail2ban-client-status-jail",
74
.params = "status {{jail}}",
@@ -69,6 +77,14 @@ struct command {
77
[1] = NULL,
78
},
79
},
80
+ {
81
+ .name = "fail2ban-client-status-jail-socket",
82
+ .params = "-s {{socket_path}} status {{jail}}",
83
+ .search = {
84
+ [0] = "fail2ban-client",
85
+ [1] = NULL,
86
+ },
87
+ },
88
{
89
.name = "storcli-controllers-info",
90
.params = "/cALL show all J nolog",
src/go/plugin/go.d/modules/fail2ban/exec.go
+26
-6
@@ -6,6 +6,7 @@ import (
6
"context"
7
"errors"
8
"fmt"
9
+ "os"
10
"os/exec"
11
"strings"
12
"time"
@@ -15,27 +16,46 @@ import (
16
17
var errJailNotExist = errors.New("jail not exist")
18
19
+const socketPathInDocker = "/host/var/run/fail2ban/fail2ban.sock"
20
+
21
func newFail2BanClientCliExec(ndsudoPath string, timeout time.Duration, log *logger.Logger) *fail2banClientCliExec {
22
+ _, err := os.Stat("/host/var/run")
23
+
24
return &fail2banClientCliExec{
20
- Logger: log,
21
- ndsudoPath: ndsudoPath,
22
- timeout: timeout,
25
+ Logger: log,
26
+ ndsudoPath: ndsudoPath,
27
+ timeout: timeout,
28
+ isInsideDocker: err == nil,
29
}
30
}
31
32
type fail2banClientCliExec struct {
33
*logger.Logger
34
29
- ndsudoPath string
30
- timeout time.Duration
35
+ ndsudoPath string
36
+ timeout time.Duration
37
+ isInsideDocker bool
38
}
39
40
func (e *fail2banClientCliExec) status() ([]byte, error) {
41
+ if e.isInsideDocker {
42
+ return e.execute("fail2ban-client-status-socket",
43
+ "--socket_path", socketPathInDocker,
44
+ )
45
+ }
46
return e.execute("fail2ban-client-status")
47
}
48
49
func (e *fail2banClientCliExec) jailStatus(jail string) ([]byte, error) {
38
- return e.execute("fail2ban-client-status-jail", "--jail", jail)
50
+ if e.isInsideDocker {
51
+ return e.execute("fail2ban-client-status-jail-socket",
52
+ "--jail", jail,
53
+ "--socket_path", socketPathInDocker,
54
+ )
55
+ }
56
+ return e.execute("fail2ban-client-status-jail",
57
+ "--jail", jail,
58
+ )
59
}
60
61
func (e *fail2banClientCliExec) execute(args ...string) ([]byte, error) {
src/go/plugin/go.d/modules/fail2ban/metadata.yaml
+10
-1
@@ -44,7 +44,16 @@ modules:
44
description: ""
45
setup:
46
prerequisites:
47
- list: []
47
+ list:
48
+ - title: For Netdata running in a Docker container
49
+ description: |
50
+ 1. **Install Fail2ban client**.
51
+
52
+ Ensure `fail2ban-client` is available in the container by setting the environment variable `NETDATA_EXTRA_DEB_PACKAGES=fail2ban` when starting the container.
53
+
54
+ 2. **Mount host's `/var/run` directory**.
55
+
56
+ Mount the host machine's `/var/run` directory to `/host/var/run` inside your Netdata container. This grants Netdata access to the Fail2ban socket file, typically located at `/var/run/fail2ban/fail2ban.sock`.
57
configuration:
58
file:
59
name: go.d/fail2ban.conf