Server Tools: Firewall, Fail2Ban, Logs and Status

System-level commands of Server Tools: UFW firewall (status, allow and deny ports), Fail2Ban (jails, banned IPs, unban), log viewer with search and the system status overview.

Deutsche Version

Back to overview

Firewall, Fail2Ban, Logs and Status

Firewall (UFW)

Alias: fw. ufw is required. Without the package the commands report UFW is not installed.

server-tools firewall status
server-tools firewall allow --port 443 --proto tcp
server-tools firewall deny --port 8080

Command	Effect
`status`	Prints `ufw status verbose`
`allow --port <n> [--proto tcp\\|udp]`	`ufw allow <n>/<proto>`, without `--proto` `ufw allow <n>` (TCP and UDP)
`deny --port <n> [--proto tcp\\|udp]`	`ufw deny <n>/<proto>` or `ufw deny <n>`

The port must be a number from 1 to 65535. Every change is recorded in the audit log.

The menu "Firewall Management" additionally offers:

Remove rule: shows ufw status numbered, asks for the rule number and for a confirmation and deletes the rule.
Enable/Disable firewall: switches on or off depending on the current state, after a confirmation. When enabling, the tool warns that SSH (port 22) must be allowed. It does not create a rule for it.

Fail2Ban

Alias: f2b. fail2ban-client is required.

server-tools fail2ban status
server-tools fail2ban banned
server-tools fail2ban unban --ip 203.0.113.10

Command	Effect
`status`	All active jails with currently and total banned IPs
`banned`	Banned IPs, grouped by jail
`unban --ip <ipv4>`	Looks up the IP in all jails, asks `Unban IP '<ip>' from all jails?` and unbans it everywhere it is banned

For unban the IP must be a valid IPv4 address. If it is not banned in any jail, the command ends with an error.

Logs

Alias: log.

server-tools logs webserver --domain example.com --lines 100
server-tools logs webserver-errors --domain example.com
server-tools logs mysql --lines 20
server-tools logs audit --filter "Created database"
server-tools logs search --pattern "timeout" --domain example.com

Action	Source
`webserver` (alias `apache`)	Webserver access log, with `--errors` the error log
`webserver-errors` (alias `apache-errors`)	Webserver error log
`mysql`	`ST_MYSQL_LOG_FILE`
`audit`	`ST_AUDIT_LOG`, with `--filter` only matching lines
`search`	See below

Options:

--lines <n> limits the output, default ST_LOG_LINES. An invalid value is replaced by the default.
--domain <d> selects the logs of a domain.

Which file is read:

Without `--domain`	With `--domain`
`<log directory>/access.log` or `error.log`, the directory is `ST_APACHE_LOG_DIR` or `ST_NGINX_LOG_DIR` depending on `ST_WEBSERVER`	`/var/www/<domain>/logs/access.log` or `error.log`, otherwise `<log directory>/<domain>-access.log` or `<domain>-error.log`

Without --domain, logs search searches the global webserver error log, the MySQL log and the audit log, with --domain the error and access log of the domain. The pattern is a regular expression, case-insensitive. For each file the last --lines matches appear. logs audit --filter works the same way.

Audit log

Every changing action writes a line to ST_AUDIT_LOG (mode 600), provided ST_AUDIT_LOGGING=true:

[2026-01-15 10:30:00] [INFO] user=root action=Created database: shop_db with user: shop_user

user is the value of SUDO_USER, otherwise the current user. Line breaks in the action are removed. In practice the levels INFO and ERROR occur.

Status

server-tools status

The command needs no options and also works without a terminal (SSH call, cron). It shows:

Service Status: the webserver service (apache2 or nginx), mysql and all php<version>-fpm services of the versions from ST_PHP_VERSIONS_TO_SCAN that are installed. Possible values are running, stopped, not installed and unknown (no systemd).
System Resources: operating system, hostname, load, memory (free -h) and disks (df -h).
Software Versions: webserver, MySQL and the PHP versions with an FPM socket.
Configuration: the output of --config.
Backups: content of ST_BACKUP_DIR and the retention period.

The example shows the format of the first block, the values depend on the server: