Knowledge Base

Unable to activate Fail2Ban jails or start Fail2Ban: No file(s) found for glob /var/log/maillog

When switching on jails in Plesk at Tools & Settings > IP Address Banning (Fail2Ban) > Jails, the operation fails with one of the following error messages:
Unable to switch on the selected jails: f2bmng failed: ERROR No file(s) found for glob /var/log/secure
ERROR Failed during configuration: Have not found any log file for ssh jail
fail2ban.jailreader [8610]: ERROR No file(s) found for glob /var/log/maillog
fail2ban.jailreader [8610]: ERROR No file(s) found for glob /var/log/psa-horde/psa-horde.log
fail2ban.jailreader [8610]: ERROR No file(s) found for glob /var/log/plesk-roundcube/errors
When activating Fail2Ban at Tools & Settings > IP Address Banning (Fail2Ban) > Settings, the operation is successful, but the option Enable intrusion detection is still disabled.
The fail2ban status reports one of these errors:
# service fail2ban status
...
fail2ban [8610]: ERROR Failed during configuration: Have not found any log file for plesk-postfix jail
fail2ban-client[12099]: ERROR Failed during configuration: Have not found any log file for plesk-horde jail

The jail mentioned in the Fail2Ban status is enabled in Fail2Ban configuration, but the logfile for this jail is absent.

Note: If this is a new server with AlmaLinux OS, check this KB article.

Solution I: Create required logfiles/directories

Connect to the Plesk server via SSH.
Create the missing logfiles manually and assign required ownership for them:
# touch /var/log/maillog && chmod 640 /var/log/maillog
# mkdir /var/log/psa-horde && touch /var/log/psa-horde/psa-horde.log && chown horde_sysuser:horde_sysgroup /var/log/psa-horde/psa-horde.log
# touch /var/log/plesk-roundcube/errors && chown roundcube_sysuser:roundcube_sysgroup /var/log/plesk-roundcube/errors && chmod 640 /var/log/plesk-roundcube/errors
# touch /var/log/secure && chmod 600 /var/log/secure
Start Fail2Ban:
# service fail2ban start

Solution II: Disable the jail

Connect to the Plesk server via SSH.
Open the file /etc/fail2ban/jail.local in a text editor. In this example, we are using the vi editor:
# vi /etc/fail2ban/jail.local
Find the component mentioned in the error message (in this example, the component is psa-horde) and remove it from the file:
[plesk-horde]
enabled = true
Save the changes and close the file.
Start Fail2Ban:
# service fail2ban start

Knowledge Base

Hosting Wiki