[BR]: fail2ban not banning specific IP about fail2ban HOT 2 CLOSED

I did some investigation and found warning in the fail2ban.log:

2024-01-14 12:25:14,007 fail2ban.filtersystemd  [3391542]: NOTICE  [postgresql-auth] Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.

I recall that few days ago (09.01.2024) fail2ban package was update in debian, and in fact I found following note in the changelog:

  * Add backend = systemd to jail.d/defaults-debian.conf

Is it possible that this change to the default backed caused fail2ban to loose track of the postgresql log position? I started observing issues on 10.01 and currently I added backend = polling to the postgresql jail config.

from fail2ban.

* Add backend = systemd to jail.d/defaults-debian.conf

Huh... No idea why it happens there.
There was a suggestion #3292 (comment) but it'd only affect sshd jail.

Is it possible that this change to the default backed caused fail2ban to loose track of the postgresql log position?

No, that will not happen, since fail2ban holds lastfilepos differently in table logs.

I added backend = polling to the postgresql jail config.

backend = auto or backend = pyinotify will be better (if pyinotify is available).

Anyway, since we are not really responsible to changes in maintainer repos, I'll close the issue here.
Don't hesitate to ping us if we'd reopen it for some reason.

from fail2ban.