"pfBlocker IP Block Counts" not working anymore about pfmailreport HOT 8 CLOSED

I'm having trouble reproducing the issue on my end, but it does look like the patch directly affects the way pfblockerng.widget parses data into columns.

If you run the command directly from the console does the HTML output look correct? Check /var/log/pfblockerng/ip_block.log and see if columns 16,17,18,19 look to be the correct data. Also make sure the delimiter is still a comma and it wasn't changed to a space/tab etc. This is the portion of the command that's most likely failing, hopefully that helps.

cut -d',' -f16,17,18,19

Let me know if they did change the columns. Maybe there is a pattern matching technique I can do on IP addresses and iterate over all columns. This way if they add data fields in the future it makes the command more versatile.

from pfmailreport.

Hi, running the command grep "$(date -v-1d "+%b %d" | sed 's/0//')" /var/log/pfblockerng/ip_block.log | cut -d',' -f16,17,18,19 | sort | uniq -c | sed 's/,/ /g' | { echo "Count IP-Address Feed Source Target" ; cat ; echo ; } | sh /usr/local/bin/pfMailReport.sh -t 'pfBlocker IP Block Counts' doesn't work from the console.
It reports: Illegal variable name ... seems "$(date -v-1d "+%b %d" | sed 's/0//')" is not something that works in FreeBSD TCSH.

If I change "$(date -v-1d "+%b %d" | sed 's/0//')" into `date -v-1d "+%b %d" | sed 's/0//'` then it fails on the {.
However the { ... } part works fine via the pfSense Email Reports for other commands... I get the emails.

If I try the following:
set day=`date -v-1d "+%b %d" | sed 's/0//'` ; grep "$day" /var/log/pfblockerng/ip_block.log | cut -d',' -f16,17,18,19 | sort | uniq -c | sed 's/,/ /g'
I get the following:
2 94.190.192.0/23 BG_v4 ip-200-193.tcv.bg wan
1 94.21.0.0/16 HU_v4 94-21-138-29.pool.digikabel.hu wan
14 94.228.240.0/20 RU_v4 Unknown wan
1 94.233.0.0/16 RU_v4 Unknown wan
1 94.236.128.0/17 BG_v4 valentin-buh.pppoe.optic-com.eu wan
So I think cut -d',' -f16,17,18,19 is doing what it needs to do.

However, if I do via de pfSense Email Reports the following full command: set day=`date -v-1d "+%b %d" | sed 's/0//'` ; grep "$day" /var/log/pfblockerng/ip_block.log | cut -d',' -f16,17,18,19 | sort | uniq -c | sed 's/,/ /g' | { echo "Count IP-Address Feed Source Target" ; cat ; echo ; } | sh /usr/local/bin/pfMailReport.sh -t 'pfBlocker IP Block Counts' , nothing is received/happens.

/T

from pfmailreport.

If you cat /var/log/pfblockerng/ip_block.log does the date format look like this? Sep 16 09:45:00
I used date "+%b" in the pfblocker_domain_block_counts.sh command, this should display the entire month rather than a single day.

from pfmailreport.

It looks like: Sep 16 01:33:39, ...
So looks good I think.
/T

from pfmailreport.

Did some further testing, and this test-command gives the html output on the console: grep "Sep 16" /var/log/pfblockerng/ip_block.log | cut -d',' -f16,17,18,19 | sort | uniq -c | sed 's/,/ /g' | sh /usr/local/bin/pfMailReport.sh -t 'pfBlocker IP Block Counts'
However when using this same command via Email Reports, nothing is sent/received.
I don't get it anymore...
/T

from pfmailreport.

Unfortunately I'm unable to reproduce this issue on my instance of pfsense / pfblockerng. The only difference between your experiments and mine were date -v-1d which produces the previous day, in this case Sep 15

from pfmailreport.

What about if you use awk to format the date string?
date | awk '{ print $2, $3 }'

from pfmailreport.

Hi, this morning I was able to pinpoint the issue... seems that if there is a lot of data to be put in the email, the email can't be send.
Your command fully works from the command line, but the amount of data in my case was too much... I block a lot!
So I narrowed down the data to a top 100, and that solved it for me.
Info comes maybe in handy... :-)
/T

from pfmailreport.