- Linux Debian Trixie
- Fail2Ban v1.1.0
cat jail.local
[DEFAULT]
backend = systemd
destemail = my@email.address
sender = my@email.address
mta = sendmail
ignoreip = 9.9.9.9
protocol = tcp udp
port = 0:65535
bantime = 1d
findtime = 7d
bantime.rndtime = 10000
maxretry = 1
maxmatches = %(maxretry)s
banaction = nftables-multiport
banaction_allports = nftables-allports
chain = f2b
action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
%(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath="%(backend)s", chain="%(chain)s"]
action = %(action_mwl)s
my_custom_action
enabled = true
dbpurgeage = 90d
[sshd]
mode = aggressive
enabled = true
filter = sshd
ignoreip = 127.0.0.1/8 ::1/128
my_custom_action, which will fail because of the last field <matches>
[Definition]
# norestored = 1
name = my_custom_action
actionban = /bin/echo "<name>;<fq-hostname>;<ip>;<ip-host>;<matches>" >> my_custom_action.log
The goal is to trigger an IP lookup to get country, ASN, CIDR, etc.. info.
Before doing that, as a test I have created a simple echo “jailname, ip host fq-hostnam matches” > my_custom_action.log
This test is working partially. When I restart fail2ban (systemctl restart fail2ban) some data is in that log file. If an new IP gets banned after the restart, I get the mail notification about it, the IP is really banned (IP in the nftables chain) but the new banned IP data is not in the log.
my_custom_action.log
mx_postfix_sasl;host.domain.tld;97.211.156.184;184.sub-97-211-156.myvzw.com;2026-07-16T11:22:43.4309234+02:00 host postfix/smtpd[365934]: warning: 184.sub-97-211-156.myvzw.com[97.211.156.184]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=someone@my_domain.tld
mx_postfix_sasl;host.domain.tld;97.213.107.239;239.sub-97-213-107.myvzw.com;2026-06-24T04:22:02.223489+02:00 mx1 postfix/smtpd[145679]: warning: 239.sub-97-213-107.myvzw.com[97.213.107.239]: SASL LOGIN authentication failed: (reason unavailable), sasl_username=theotherone@my_domain.tld
So, why is only some partial data in that log, or how do I set up that custom_action correctly?
Removed the last field and it seems to be working
my_custom_action (working version)
[Definition]
# norestored = 1
name = my_custom_action
actionban = /bin/echo "<name>;<fq-hostname>;<ip>;<ip-host>" >> /var/log/my_custom_action.log
