Skip to content

Commit 30e00ff

Browse files
itcmsgritcmsgr
authored
Merge pull request #437 from itcmsgr/feat/v1.91-pipeline-unification
feat: v1.91 pipeline unification + fail2ban decommission
2 parents 1367e42 + e8cf974 commit 30e00ff

11 files changed

Lines changed: 45 additions & 50 deletions

File tree

‎cli/lib/nftban/data/metrics-registry.json‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -654,7 +654,7 @@
654654
"labels": {
655655
"component": {
656656
"type": "enum",
657-
"values": ["nftables", "polkit", "ssh", "fail2ban"],
657+
"values": ["nftables", "polkit", "ssh"],
658658
"description": "System component"
659659
}
660660
},
@@ -883,7 +883,7 @@
883883
"go_var": "nftablesActiveGauge",
884884
"description": "NFTables service status (1=active, 0=inactive)"
885885
},
886-
"nftban_conntrack_entries": {
886+
"nftban_conntrack_used": {
887887
"type": "gauge",
888888
"unit": "",
889889
"category": "connections",
@@ -1479,7 +1479,7 @@
14791479
"category": "nftables",
14801480
"phase": 3
14811481
},
1482-
"nftban_nftables_rules_total": {
1482+
"nftban_nft_rules_total": {
14831483
"type": "gauge",
14841484
"help": "Total nftables rules",
14851485
"labels": [],
@@ -1842,7 +1842,7 @@
18421842
"added_version": "1.4.0",
18431843
"phase": 1
18441844
},
1845-
"nftban_memory_rss_bytes": {
1845+
"nftban_proc_rss_bytes": {
18461846
"type": "gauge",
18471847
"unit": "bytes",
18481848
"category": "runtime",
@@ -2216,12 +2216,12 @@
22162216
"added_version": "1.4.0",
22172217
"phase": 1
22182218
},
2219-
"nftban_watchdog_cpu_score": {
2219+
"nftban_pressure_score": {
22202220
"type": "gauge",
22212221
"unit": "percent",
22222222
"category": "watchdog",
22232223
"source": "shell_prometheus",
2224-
"description": "Watchdog CPU pressure score (0-100)",
2224+
"description": "Watchdog pressure score (0-100), label dim=cpu|mem|io|net",
22252225
"labels": {},
22262226
"added_version": "1.4.0",
22272227
"phase": 1
@@ -2995,15 +2995,15 @@
29952995
"nftban_daemon_up": "nftban.daemon.up",
29962996
"nftban_daemon_uptime_seconds": "nftban.uptime",
29972997
"nftban_watchdog_up": "nftban.watchdog.up",
2998-
"nftban_watchdog_cpu_score": "nftban.watchdog.cpu.score",
2999-
"nftban_watchdog_mem_score": "nftban.watchdog.mem.score",
3000-
"nftban_watchdog_io_score": "nftban.watchdog.io.score",
2998+
"nftban_pressure_score{dim=cpu}": "nftban.watchdog.cpu.score",
2999+
"nftban_pressure_score{dim=mem}": "nftban.watchdog.mem.score",
3000+
"nftban_pressure_score{dim=io}": "nftban.watchdog.io.score",
30013001
"nftban_blocks_total": "nftban.blocks.total",
30023002
"nftban_bans_last_24h": "nftban.bans.last.24h",
30033003
"nftban_bans_last_1h": "nftban.bans.last.1h",
30043004
"nftban_throughput_bans_per_minute": "nftban.throughput.bans.per.minute",
30053005
"nftban_runtime_goroutines": "nftban.goroutines",
3006-
"nftban_conntrack_entries": "nftban.conntrack.entries",
3006+
"nftban_conntrack_used": "nftban.conntrack.entries",
30073007
"nftban_conntrack_max": "nftban.conntrack.max",
30083008
"nftban_conntrack_utilization": "nftban.conntrack.utilization",
30093009
"nftban_softnet_drops_total": "nftban.softnet.drops.total",
@@ -3046,8 +3046,8 @@
30463046
"nftban_modules_active": "nftban.modules.active",
30473047
"nftban_modules_failed": "nftban.modules.failed",
30483048
"nftban_watchdog_status": "nftban.watchdog.status",
3049-
"nftban_watchdog_mode": "nftban.watchdog.mode",
3050-
"nftban_watchdog_net_score": "nftban.watchdog.net_score",
3049+
"nftban_operating_mode": "nftban.watchdog.mode",
3050+
"nftban_pressure_score{dim=net}": "nftban.watchdog.net_score",
30513051
"nftban_watchdog_actions_taken": "nftban.watchdog.actions_taken",
30523052
"nftban_watchdog_last_action": "nftban.watchdog.last_action",
30533053
"nftban_watchdog_mode_changes": "nftban.watchdog.mode_changes",

‎cli/lib/nftban/exporters/nftban_unified_exporter_collect.sh‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,7 @@ collect_all_metrics() {
449449
fds=${fds//[[:space:]]/} # strip whitespace from wc -l
450450
threads=$(awk '/Threads/ {print $2}' "/proc/$pid/status" 2>/dev/null || echo "0")
451451

452-
metrics+="nftban_memory_rss_bytes $rss $timestamp\n"
452+
metrics+="nftban_proc_rss_bytes $rss $timestamp\n"
453453
metrics+="nftban_open_fds $fds $timestamp\n"
454454
metrics+="nftban_threads $threads $timestamp\n"
455455

@@ -474,7 +474,7 @@ collect_all_metrics() {
474474
fi
475475
# Fallback: use thread count as approximation if goroutines not available
476476
[[ "$goroutines" == "0" || -z "$goroutines" ]] && goroutines=$threads
477-
metrics+="nftban_goroutines $goroutines $timestamp\n"
477+
metrics+="nftban_runtime_goroutines $goroutines $timestamp\n"
478478

479479
# --- Memory Leak Detection Metrics ---
480480
# Calculate memory growth rate (MB/hour) for leak detection
@@ -591,7 +591,7 @@ collect_all_metrics() {
591591
fi
592592
metrics+="nftban_nftables_apply_errors_total $nft_apply_errors $timestamp\n"
593593

594-
# nftban_nftables_rules_total - count rules in nftban table
594+
# nftban_nft_rules_total - count rules in nftban table
595595
local nft_rules_total=0
596596
local table_output
597597
table_output=$(nft list table ${NFTBAN_TABLE_IPV4} 2>/dev/null || echo "")
@@ -600,7 +600,7 @@ collect_all_metrics() {
600600
nft_rules_total=$(echo "$table_output" | grep -cE '^\s+(accept|drop|reject|jump|goto|counter|log|limit|ct )' 2>/dev/null | tr -d '[:space:]') || true
601601
[[ -z "$nft_rules_total" || ! "$nft_rules_total" =~ ^[0-9]+$ ]] && nft_rules_total=0
602602
fi
603-
metrics+="nftban_nftables_rules_total $nft_rules_total $timestamp\n"
603+
metrics+="nftban_nft_rules_total $nft_rules_total $timestamp\n"
604604

605605
# nftban_nftables_sets_total - count sets in nftban table
606606
local nft_sets_total=0
@@ -856,17 +856,20 @@ collect_all_metrics() {
856856
net_score=$(jq -r '.net_score // 0' "${NFTBAN_RUN_DIR}/watchdog.status" 2>/dev/null || echo "0")
857857
watchdog_mode=$(jq -r '.mode // "NORMAL"' "${NFTBAN_RUN_DIR}/watchdog.status" 2>/dev/null || echo "NORMAL")
858858

859-
metrics+="nftban_watchdog_cpu_score $cpu_score $timestamp\n"
860-
metrics+="nftban_watchdog_mem_score $mem_score $timestamp\n"
861-
metrics+="nftban_watchdog_io_score $io_score $timestamp\n"
862-
metrics+="nftban_watchdog_net_score $net_score $timestamp\n"
863-
# Mode as numeric: 0=NORMAL, 1=DEGRADED, 2=SURVIVAL
864-
local mode_num=0
859+
metrics+="nftban_pressure_score{dim=\"cpu\"} $cpu_score $timestamp\n"
860+
metrics+="nftban_pressure_score{dim=\"mem\"} $mem_score $timestamp\n"
861+
metrics+="nftban_pressure_score{dim=\"io\"} $io_score $timestamp\n"
862+
metrics+="nftban_pressure_score{dim=\"net\"} $net_score $timestamp\n"
863+
# Mode as one-hot vector matching daemon nftban_operating_mode{mode=X}
864+
local mode_normal=0 mode_degraded=0 mode_survival=0
865865
case "$watchdog_mode" in
866-
DEGRADED) mode_num=1 ;;
867-
SURVIVAL) mode_num=2 ;;
866+
NORMAL) mode_normal=1 ;;
867+
DEGRADED) mode_degraded=1 ;;
868+
SURVIVAL) mode_survival=1 ;;
868869
esac
869-
metrics+="nftban_watchdog_mode $mode_num $timestamp\n"
870+
metrics+="nftban_operating_mode{mode=\"normal\"} $mode_normal $timestamp\n"
871+
metrics+="nftban_operating_mode{mode=\"degraded\"} $mode_degraded $timestamp\n"
872+
metrics+="nftban_operating_mode{mode=\"survival\"} $mode_survival $timestamp\n"
870873
fi
871874
metrics+="nftban_watchdog_up 1 $timestamp\n"
872875
else
@@ -908,7 +911,7 @@ collect_all_metrics() {
908911
metrics+="nftban_daemon_uptime_seconds $d_uptime $timestamp\n"
909912
metrics+="nftban_daemon_memory_heap_mb $d_heap $timestamp\n"
910913
metrics+="nftban_daemon_memory_sys_mb $d_sys $timestamp\n"
911-
metrics+="nftban_daemon_goroutines $d_goroutines $timestamp\n"
914+
metrics+="nftban_runtime_goroutines $d_goroutines $timestamp\n"
912915
metrics+="nftban_daemon_gc_cycles_total $d_gc_cycles $timestamp\n"
913916
metrics+="nftban_daemon_gc_pause_ms $d_gc_pause $timestamp\n"
914917

@@ -1266,7 +1269,7 @@ collect_all_metrics() {
12661269
if [[ $conntrack_max -gt 0 ]]; then
12671270
conntrack_utilization=$(awk -v e="$conntrack_entries" -v m="$conntrack_max" 'BEGIN {printf "%.2f", (e/m)*100}')
12681271
fi
1269-
metrics+="nftban_conntrack_entries $conntrack_entries $timestamp\n"
1272+
metrics+="nftban_conntrack_used $conntrack_entries $timestamp\n"
12701273
metrics+="nftban_conntrack_max $conntrack_max $timestamp\n"
12711274
metrics+="nftban_conntrack_utilization $conntrack_utilization $timestamp\n"
12721275
fi

‎cli/lib/nftban/exporters/nftban_unified_exporter_export.sh‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,8 +177,8 @@ export_prometheus() {
177177
# TYPE nftban_feeds_enabled gauge
178178
# HELP nftban_feeds_loaded Number of successfully loaded feeds
179179
# TYPE nftban_feeds_loaded gauge
180-
# HELP nftban_memory_rss_bytes Daemon RSS memory in bytes
181-
# TYPE nftban_memory_rss_bytes gauge
180+
# HELP nftban_proc_rss_bytes Daemon RSS memory in bytes
181+
# TYPE nftban_proc_rss_bytes gauge
182182
# HELP nftban_export_attempts_total Number of export attempts by target
183183
# TYPE nftban_export_attempts_total counter
184184
# HELP nftban_export_success_total Number of successful exports by target
@@ -198,6 +198,10 @@ PROM_HEADER
198198
# Skip Zabbix string metrics (containing |STRING| prefix)
199199
if (index($2, "|STRING|") == 1) next
200200
201+
# Skip dot-notation metrics (Zabbix format, invalid Prometheus names)
202+
# Valid Prometheus: [a-zA-Z_:][a-zA-Z0-9_:]*
203+
if (index($1, ".") > 0) next
204+
201205
if (NF >= 2) {
202206
# Handle metrics with labels
203207
if ($1 ~ /{.*}/) {

‎cmd/nftban-core/cmd_analytics.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -329,9 +329,6 @@ func cmdAnalyticsIP() error {
329329
fmt.Printf("City: %s\n", origin.City)
330330
}
331331
fmt.Printf("Banned At: %s\n", origin.BannedAt.Format("2006-01-02 15:04:05"))
332-
if origin.Jail != "" {
333-
fmt.Printf("Jail: %s\n", origin.Jail)
334-
}
335332
if origin.Reason != "" {
336333
fmt.Printf("Reason: %s\n", origin.Reason)
337334
}

‎install/grafana/dashboards/nftban_performance.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@
153153
"uid": "${DS_PROMETHEUS}"
154154
},
155155
"editorMode": "code",
156-
"expr": "nftban_nftables_rules_total",
156+
"expr": "nftban_nft_rules_total",
157157
"legendFormat": "Rules Count",
158158
"range": true,
159159
"refId": "A"
@@ -484,7 +484,7 @@
484484
"uid": "${DS_PROMETHEUS}"
485485
},
486486
"editorMode": "code",
487-
"expr": "nftban_nftables_rules_total",
487+
"expr": "nftban_nft_rules_total",
488488
"legendFormat": "Rules Count",
489489
"range": true,
490490
"refId": "A"

‎install/prometheus/alerts/nftban-metrics.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ groups:
152152
rules:
153153
# Alert if nftables rule count is very high
154154
- alert: NFTBanHighRuleCount
155-
expr: nftban_nftables_rules_total > 10000
155+
expr: nftban_nft_rules_total > 10000
156156
for: 10m
157157
labels:
158158
severity: warning

‎internal/analytics/state.go‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -226,11 +226,10 @@ func (s *State) RecordBan(ip, country, city, source, reason string, t time.Time)
226226
Country: country,
227227
City: city,
228228
BannedAt: t,
229-
Jail: source, // Legacy compatibility
230-
Source: source, // New: suricata, login-monitor, manual, feeds
231-
Service: service, // New: Dynamic service extracted from reason
229+
Source: source,
230+
Service: service,
232231
Reason: reason,
233-
Duration: 0, // TODO: Add duration parameter if needed
232+
Duration: 0,
234233
}
235234
s.ipOrigins[ip] = origin
236235
origin.lruElement = s.ipOriginsLRU.PushFront(ip)
@@ -336,7 +335,6 @@ func extractServiceFromSource(source string) string {
336335
case "manual":
337336
return "manual"
338337
default:
339-
// Legacy fail2ban jail names
340338
return source
341339
}
342340
}

‎internal/analytics/types.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ type IPOrigin struct {
3838
Country string `json:"country"`
3939
City string `json:"city,omitempty"`
4040
BannedAt time.Time `json:"banned_at"`
41-
Jail string `json:"jail,omitempty"` // Legacy: fail2ban jail name
4241
Source string `json:"source,omitempty"` // suricata, login-monitor, manual, feeds
4342
Service string `json:"service,omitempty"` // ssh, http, wordpress, malware, etc.
4443
Reason string `json:"reason,omitempty"`
@@ -56,7 +55,6 @@ type DailySummary struct {
5655
TopCountries []CountryStats `json:"top_countries"`
5756
BySource map[string]int `json:"by_source"` // suricata, login-monitor, manual, feeds
5857
ByService map[string]int `json:"by_service"` // Dynamic from filters.conf
59-
ByJail map[string]int `json:"by_jail"` // Legacy fail2ban compatibility
6058
GeneratedAt time.Time `json:"generated_at"`
6159
}
6260

‎internal/api/handlers_analytics.go‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -280,8 +280,6 @@ func RecentActivityHandler(w http.ResponseWriter, r *http.Request) {
280280
activity.Type = "Port scan"
281281
case "ddos":
282282
activity.Type = "DDoS blocked"
283-
case "fail2ban":
284-
activity.Type = "Fail2Ban"
285283
case "feeds", "feed":
286284
activity.Type = "Feed update"
287285
case "manual":

‎internal/banlog/banlog.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@ const (
5555
SourceDDoS = "ddos"
5656
SourceFeeds = "feeds"
5757
SourceSuricata = "suricata"
58-
SourceFail2ban = "fail2ban" // Legacy compatibility
5958
)
6059

6160
// Status constants
@@ -193,8 +192,6 @@ func normalizeSource(source string) string {
193192
return SourceFeeds
194193
case "suricata", "ids":
195194
return SourceSuricata
196-
case "fail2ban":
197-
return SourceFail2ban
198195
default:
199196
// Keep original for unknown sources
200197
return source

0 commit comments

Comments
 (0)