Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Some of them.
Have I searched the tickets before posting? Yes
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 2.5.8
PHP version: 5.3.15
MySQL version: 5.5.24-cll
Host: dedicated server
Admin Tools version: 2.4.2
 
Description of my issue:

I have noticed after upgrading AT Pro that the WAF Auto-ban Repeat Offenders is not working in Admin Tools version 2.4.2

I have attached a screenshot of my WAF settings for the auto-ban and it's set to block IPs after only 3 attempts in 3 hours. However, I haven't had any IPs auto-banned since I upgraded to the latest version of AT Pro. I am getting many emails from the same IPs in a short period and none are getting auto-blocked.  For example, I received the following security exception alert email over 25 times in less than 3 hours (sometimes 5 emails sent at the same time) for this IP.

We would like to notify you that a security exception was detected on your site, XXXXXXXXXXX, with the following details:

IP Address: 207.46.119.86 (IP Lookup: http://ip-lookup.net/index.php?ip=207.46.119.86)
Reason: tmpl= in URL

If this kind of security exception repeats itself, please log in to your site's back-end and add this IP address to your Admin Tools's Web Application Firewall feature in order to completely block the misbehaving user.

This is happening with other IPs also and none are getting auto-banned. I know I can add the IPs to the Site IP Blacklist. But I would like to know how to get the auto-ban feature working again since it saves me the trouble of having to login to manually add IPs to the Blacklist.

Thanks for any advice!

Nicholas,

I didn't realize that turning off the Log Security Exceptions would disable the auto-ban feature. So that was the cause of the missing auto-ban emails. I disabled the Log Security Exceptions because I had over 100 pages in the security exceptions log feature of alerts.

Is there a way to easily delete tons of pages of alerts in the log section? I tried using the "Show All" feature of display option but that won't work when you too many alerts to display and then delete. I guess Joomla locks up when the lists are too long. So the only option was to delete 100 log alerts at a time which takes a while when you have too many.

Is there an easier way to clear out the log alerts in the WAF? For example, is it better to use phpMyAdmin to clear out the log alerts table when it gets too big? I have DB Replacer Pro so I guess that's another option, unless you think it could create problems with AT Pro.