diff --git a/ChangeLog b/ChangeLog index 0b126b16..b25b891e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -63,6 +63,11 @@ ver. 0.10.5-dev-1 (20??/??/??) - development edition ----------- ### Fixes +* [grave] fixed parsing of multi-line filters (`maxlines` > 1) together with systemd backend, + now systemd-filter replaces newlines in message from systemd journal with `\n` (otherwise + multi-line parsing may be broken, because removal of matched string from multi-line buffer window + is confused by such extra new-lines, so they are retained and got matched on every followed + message, see gh-2431) * fixed read of included config-files (`.local` overwrites options of `.conf` for config-files included with before/after) * `action.d/helpers-common.conf`: rewritten grep arguments, now options `-wF` used to match only diff --git a/fail2ban/server/filtersystemd.py b/fail2ban/server/filtersystemd.py index f3ffc827..5f17596a 100644 --- a/fail2ban/server/filtersystemd.py +++ b/fail2ban/server/filtersystemd.py @@ -236,7 +236,7 @@ class FilterSystemd(JournalFilter): # pragma: systemd no cover logSys.log(5, "[%s] Read systemd journal entry: %s %s", self.jailName, date.isoformat(), logline) ## use the same type for 1st argument: - return ((logline[:0], date.isoformat(), logline), + return ((logline[:0], date.isoformat(), logline.replace('\n', '\\n')), time.mktime(date.timetuple()) + date.microsecond/1.0E6) def seekToTime(self, date):