The Found xxx.xxx.xxx.xxx
message means, that the fail2ban filter found a line that matches failregex in the given filter/jail logfile.
For example if the log shows
2016-03-16 15:35:51,527 fail2ban.filter [1986]: INFO [sshd] Found 1.2.3.4 2016-03-16 15:35:51,817 fail2ban.filter [1986]: INFO [sshd] Found 1.2.3.4 2016-03-16 15:35:52,537 fail2ban.actions [1986]: NOTICE [sshd] Ban 1.2.3.4
The two first Found
mean, that IP address 1.2.3.4 was found 2 times in the given sshd log (e.g. /var/log/auth.log) and that the entry in the logfile matches failregex
in the filter /etc/fail2ban/filter.d/sshd.conf
As I have configured to ban after 2 failed ssh-attemtps, the 3rd line shows, that IP 1.2.3.4 has been banned after those 2 found occurrences.
How I found out about this:
In the python sources of fail2ban (in Debian this is in /usr/lib/python3/dist-packages/fail2ban/
) do this:
cd /usr/lib/python3/dist-packages/fail2ban/ grep -r "\[%s\] Found" *
In the python file "server/filter.py" on line 937 you find the corresponding log function:
def processLineAndAdd(self, line, date=None): [..] logSys.info("[%s] Found %s" % (self.jail.name, ip)) [..]