Using a general journalctl command, the log line of interest appears:
[root@bee server]# journalctl -n
-- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 21:41:12 EEST. --
...
Jun 10 21:41:12 bee ownCloud[25476]: {core} Login failed: 'ewrf' (Remote IP: '172.16.0.2', X-Forwarded-For: '')
How could I reach this ownCloud
line with the -u
option, aka _SYSTEMD_UNIT
?
[root@bee server]# journalctl -u ownCloud
-- Logs begin at Mon 2015-01-26 19:44:33 EET, end at Wed 2015-06-10 22:01:02 EEST. --
I need to specify the journalmatch variable in the relevant owncloud filter file for fail2ban.
[root@bee server]# cat /etc/fail2ban/filter.d/owncloud-login.conf
[Definition]
failregex = {"app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>', X-Forwarded-For: '.*'\)","level":2,"time":".*"}
Ignoreregex =
[Init]
# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 10
journalmatch = _SYSTEMD_UNIT=ownCloud
Could I possibly use a regex pattern? How?
$man journalctl
...
-u, --unit=UNIT|PATTERN
Show messages for the specified systemd unit UNIT (such as a service unit), or for any of the units matched by PATTERN. If a pattern is specified, a list of
unit names found in the journal is compared with the specified pattern and all that match are used. For each unit name, a match is added for messages from
the unit ("_SYSTEMD_UNIT=UNIT"), along with additional matches for messages from systemd and messages about coredumps for the specified unit.
...