pyruse/README.md

Python peruser of systemd-journal

This program is intended to be used as a lightweight replacement for both epylog and fail2ban. Its purpose is to peruse the system log entries, warn of important situations, report daily on the latest events, and act on specific patterns (IP address bans…).

• Functional overview
• Technical overview

The software requirements are:

• a modern systemd-based Linux operating system (eg. Archlinux- or Fedora-based distributions);
• python, at least version 3.1 (or more, depending on the modules being used);
• python-systemd;
• nftables if IP address bans are to be managed;
• a sendmail-like program if emails are wanted.

The /etc/pyruse directory is where system-specific files are looked-for:

• the pyruse.json file that contains the configuration,
• the pyruse/actions and pyruse/filters subfolders, which may contain additional actions and filters.

Instead of using /etc/pyruse, an alternate directory may be specified with the PYRUSE_EXTRA environment variable.

For more in-depth documentation, please refer to these pages:

• General structure of the pyruse.json file
• How do I write the pyruse.json file?
• Writing custom filters and actions
• More information about:
  • the built-in filters
  • the counter-based actions
  • the action_noop module
  • the action_email module
  • the action_dailyReport module
  • the action_nftBan module