Vincent's blog

Tuning log2table rules with real logs, and with an AI looking over my shoulder

Sat, 24 Oct 2026 17:43:00 +0100

log2table is a small daemon I wrote: it watches log files, recognizes attack patterns with regular expressions, and puts the offending IP addresses in a PF table so the firewall blocks them. The whole behavior is driven by one file: parameters.py.

Writing rules is easy. Knowing whether they are good rules is harder: do they catch what is really hitting my server today? Do they ban innocent visitors? Do two rules count the same attack twice?

This post explains the new version of parameters.py in the repository, its built-in checker that runs against your real log files, and how I used an AI (Claude, through Claude Code) to read the checker's output and propose improvements.

Thanks to log2table I'm able to secure my servers

Sun, 08 Mar 2026 18:11:00 +0100

As for each server on internet, I receive lot of bad requests. Thanks to a continuous check on different log files, I'm able to automatically add bad IPs in the pf firewall (OpenBSD). This blog will explain how I've setup log2table and how I treat those bad IPs

Log2table to protect your machines from intrusions

Sat, 27 May 2017 20:41:00 +0100

Log2table allows you to continuously monitor your logfiles. You can trigger actions when a specific message comes in your audited logfiles or when a specific number of occurrences are present.

Block bad visitors with PF

Sun, 06 Nov 2016 17:04:00 +0100

Those days, when you fire-up a new machine, it takes few hours that bad persons are trying to connect to your machine via ssh, try default URL with default passwords, ...

This post will explain how OpenBSD can easily helps you to ban those persons out of your machine for quite a long time.