Skip to content

Instantly share code, notes, and snippets.

@lazyfrosch

lazyfrosch/config.yaml

Last active March 28, 2025 09:17
Show Gist options
  • Save lazyfrosch/edd0658ae9a0aaa5a716b214bb98cae6 to your computer and use it in GitHub Desktop.
Save lazyfrosch/edd0658ae9a0aaa5a716b214bb98cae6 to your computer and use it in GitHub Desktop.
Download ZIP
Fail2Ban configuration for Grafana's Loki promtail
Raw
config.yaml
server:
http_listen_port: 9080
grpc_listen_port: 0
positions:
filename: /data/positions.yaml
clients:
- url: ${LOKI_HOST}/loki/api/v1/push
basic_auth:
username: ${LOKI_USERNAME}
password: ${LOKI_PASSWORD}
scrape_configs:
- job_name: fail2ban
static_configs:
- targets:
- localhost
labels:
__path__: /var/log/fail2ban.log
job: fail2ban
nodename: ${HOSTNAME}
pipeline_stages:
- multiline:
firstline: '\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}'
- regex:
expression: >-
^(?s)(?P<time>\S+? \S+?)
(fail2ban\.)(?P<component>\S+)\s*
\[(?P<pid>\S+)\]:
(?P<priority>\S+)\s*
(?P<message>.*?)$
- timestamp:
source: time
format: '2006-01-02 15:04:05,000'
- labels:
component:
priority:
- output:
source: message
# Extract jail from message, if present
- match:
# Note: backticks do not work in promtail, so weird escaping is needed
selector: '{job="fail2ban"} |~ "\\\\[\\\\S+\\\\] .*"'
stages:
- regex:
expression: '(\[(?P<jail>\S+)\] )?(?P<message>.*?)$'
- labels:
jail:
- output:
source: message
- labeldrop:
- filename
Raw
docker-compose.yml
version: "3.2"
services:
promtail:
restart: unless-stopped
image: grafana/promtail
container_name: promtail
network_mode: host
environment:
LOKI_HOST: ${LOKI_HOST}
LOKI_USERNAME: ${LOKI_USERNAME}
LOKI_PASSWORD: ${LOKI_PASSWORD}
volumes:
- ./config.yaml:/etc/promtail/config.yml
- promtail:/data
- /var/log:/var/log:ro
command:
- -config.file=/etc/promtail/config.yml
- -config.expand-env=true
volumes:
promtail:
Raw
grafana-dashboard.json
{
"annotations": {
"list": [
{
"builtIn": 1,
"datasource": "-- Grafana --",
"enable": true,
"hide": true,
"iconColor": "rgba(0, 211, 255, 1)",
"name": "Annotations & Alerts",
"target": {
"limit": 100,
"matchAny": false,
"tags": [],
"type": "dashboard"
},
"type": "dashboard"
}
]
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 0,
"id": 20,
"links": [],
"liveNow": false,
"panels": [
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisLabel": "",
"axisPlacement": "auto",
"barAlignment": 0,
"drawStyle": "line",
"fillOpacity": 10,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineInterpolation": "linear",
"lineStyle": {
"fill": "solid"
},
"lineWidth": 1,
"pointSize": 3,
"scaleDistribution": {
"type": "linear"
},
"showPoints": "auto",
"spanNulls": false,
"stacking": {
"group": "A",
"mode": "normal"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"min": 0,
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 0,
"y": 0
},
"id": 2,
"interval": "15m",
"options": {
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "multi",
"sort": "none"
}
},
"pluginVersion": "8.4.4",
"targets": [
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"expr": "sum by (nodename) (count_over_time({job=\"fail2ban\",component=\"actions\"} |~ \"Ban .*\" [$__interval]))",
"legendFormat": "{{ nodename }}",
"refId": "A"
}
],
"title": "Bans per 15m",
"type": "timeseries"
},
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisLabel": "",
"axisPlacement": "auto",
"barAlignment": 0,
"drawStyle": "line",
"fillOpacity": 0,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineInterpolation": "linear",
"lineWidth": 1,
"pointSize": 3,
"scaleDistribution": {
"type": "linear"
},
"showPoints": "auto",
"spanNulls": false,
"stacking": {
"group": "A",
"mode": "none"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"min": 0,
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 0
},
"id": 7,
"interval": "15m",
"options": {
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "single",
"sort": "none"
}
},
"targets": [
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"expr": "sum by (nodename, component) (count_over_time({job=\"fail2ban\",priority=\"ERROR\"} [$__interval]))",
"legendFormat": "{{ nodename }}: {{component}}",
"refId": "A"
}
],
"title": "Errors per 15m",
"type": "timeseries"
},
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"fieldConfig": {
"defaults": {
"color": {
"mode": "palette-classic"
},
"custom": {
"axisLabel": "",
"axisPlacement": "auto",
"barAlignment": 0,
"drawStyle": "line",
"fillOpacity": 10,
"gradientMode": "none",
"hideFrom": {
"legend": false,
"tooltip": false,
"viz": false
},
"lineInterpolation": "linear",
"lineStyle": {
"fill": "solid"
},
"lineWidth": 1,
"pointSize": 3,
"scaleDistribution": {
"type": "linear"
},
"showPoints": "auto",
"spanNulls": false,
"stacking": {
"group": "A",
"mode": "normal"
},
"thresholdsStyle": {
"mode": "off"
}
},
"mappings": [],
"min": 0,
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"gridPos": {
"h": 8,
"w": 12,
"x": 0,
"y": 8
},
"id": 3,
"interval": "15m",
"options": {
"legend": {
"calcs": [],
"displayMode": "list",
"placement": "bottom"
},
"tooltip": {
"mode": "multi",
"sort": "none"
}
},
"pluginVersion": "8.4.4",
"targets": [
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"expr": "sum by (nodename) (count_over_time({job=\"fail2ban\",component=\"actions\"} |~ \"Unban .*\" [$__interval]))",
"legendFormat": "{{ nodename }}",
"refId": "A"
}
],
"title": "Unbans per 15m",
"type": "timeseries"
},
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"gridPos": {
"h": 8,
"w": 12,
"x": 12,
"y": 8
},
"id": 5,
"options": {
"dedupStrategy": "none",
"enableLogDetails": true,
"prettifyLogMessage": false,
"showCommonLabels": false,
"showLabels": true,
"showTime": true,
"sortOrder": "Descending",
"wrapLogMessage": false
},
"targets": [
{
"datasource": {
"type": "loki",
"uid": "GJCWu4jMk"
},
"expr": "{job=\"fail2ban\",priority=\"ERROR\"}",
"maxLines": 100,
"refId": "A"
}
],
"title": "Error logs",
"type": "logs"
}
],
"schemaVersion": 35,
"style": "dark",
"tags": [],
"templating": {
"list": []
},
"time": {
"from": "now-24h",
"to": "now"
},
"timepicker": {},
"timezone": "",
"title": "Fail2Ban",
"uid": "47Lk3fP7z",
"version": 3,
"weekStart": ""
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment