fail2ban-watch.sh

#!/bin/bash
## Author: Shaun Reed | Contact: [email protected] | URL: www.shaunreed.com ##
##                                                                           ##
## A script to watch for modifications to fail2ban active jail status        ##
## Emails contents of custom log after its unmodified for 300 secconds       ##
###############################################################################

lockFile=$(find /root/ -name fail2ban-watch.lock -type f -print)

#
# Makes script wait until a file is unmodified for a given timeframe
# $1 = file, $2 = time in seconds to wait
checkmod () {
  lastModificationSeconds=$(date +%s -r $1)
  currentSeconds=$(date +%s)
  elapsedSeconds=$((currentSeconds - lastModificationSeconds))
  while [ $elapsedSeconds -lt $2 ]
  do
    lastModificationSeconds=$(date +%s -r $1)
    currentSeconds=$(date +%s)
    elapsedSeconds=$((currentSeconds - lastModificationSeconds))
    # Add some exception for abnormally long elapsedSeconds
  done
}


if [ -n "$lockFile" ]
then
  # If a lockFile exists, there is already an instance of this script running
  # Do nothing and exit normally.
  exit 0
else
  # If it doesn't exist, create a lockFile
  touch /root/fail2ban-watch.lock
  printf "/root/fail2ban-watch.lock created\n"
  touch /root/fail2bans
  # Wait for /root/fail2bans to go unmodified for 300 seconds before continuing
  checkmod "/root/fail2bans" "300"

  # After time has passed, send email
  cat /root/fail2bans | mail -s "Fail2ban active jail status has changed on $HOSTNAME" someone@somedomain.com
  # Clean up files
  rm /root/fail2ban-watch.lock /root/fail2bans
fi