#! /usr/bin/env perl

# Copyright (c) 2026 R. W. Rodolico
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
# THE POSSIBILITY OF SUCH DAMAGE.

# Author: R. W. Rodolico
# Date: 2026-09-13
# getFail2BanJailStats
#
# Script to get Fail2Ban jail statistics
# Usage: ./getFail2BanJailStats
#
# Output format is a tab separated list:
#   Jail    Current Total   IPs
# for each detected jail, will display the
#   - current number of banned IPs
#   - the total number of banned IPs
#   - the list of banned IPs
#
# NOTE: the list of banned IPs can be very long, and it is space separated.
#       You can parse it accordingly, or just truncate the list if it is
#       too long.
#
# See sample output at the end of this script.

use strict;
use warnings;

# Command to get the list of jails from Fail2Ban
my $command = "fail2ban-client status | grep 'Jail list:' | cut -d':' -f2";

# Get the list of jails from Fail2Ban and split them into an array
my @jails = split /,/,
    do {
        my $s = `$command`;
        $s =~ s/\s+//g;
        $s;
    };

# Print the header for the output
print "Jail\tCurrent\tTotal\tIPs\n";

# Iterate over each jail and get its statistics
foreach my $jail ( sort @jails ) {
    next if $jail =~ m/^\s*$/;    # Skip empty jail names (should not happen normally)

    my $output = `fail2ban-client status $jail`;    # Get the status output for the current jail

    # $output is a multiline string containing the status of the current jail, so we
    # need a regular expression to extract the relevant information. @out will contain
    # the captured groups: current banned, total banned, and banned IP list.
    my @out = $output =~ /
        Currently\ banned:\s*(\d+).*
        Total\ banned:\s*(\d+).*
        Banned\ IP\ list:\s*([0-9 .]*)
    /xs;    # x = extended whitespace/comments, s = single-line mode (dot matches newline)

    unshift @out, $jail;         # prepend the jail name to the output array
    print join( "\t", @out );    # print the statistics for the current jail
    print "\n";
}

1;

# Sample output:
# Jail       Current Total   IPs
# recidive   3       3       20.151.10.161 4.204.224.164 91.122.31.16
#
# Sample of the Fail2Ban client status output for a jail:
# Status for the jail: recidive
# |- Filter
# |  |- Currently failed:	84
# |  |- Total failed:	88
# |  `- File list:	/var/log/fail2ban.log
# `- Actions
#    |- Currently banned:	3
#    |- Total banned:	3
#    `- Banned IP list:	20.151.10.161 4.204.224.164 91.122.31.16