IpBan doesn't work anymore since updated to 1.7.1

[JohnnySixter]

Hello,

I use this software since 1.6.0 so it's quite new for me.
About that, it's a very efficiency tool. So thanks for that ! :)

Today I updated to 1.7.1 from 1.7.0.
I simply deleted the old folder and replaced it the new one. I did it when I updated to 1.70 from 1.6.0 and it worked well.
But this time, the tool stopped at "Firewall entries updated":

2022-03-24 22:01:32.5579|WARN|IPBan|Initializing service
2022-03-24 22:01:32.6342|WARN|IPBan|Detecting os version...
2022-03-24 22:01:32.7510|WARN|IPBan|OS version detected: Name: Windows, Version: 10.0.14393, Friendly Name: Microsoft Windows Server 2016 Essentials, Description: Microsoft Windows 10.0.14393, app version: 1.7.1
2022-03-24 22:01:32.7866|WARN|IPBan|Running as a console app
2022-03-24 22:01:32.8987|WARN|IPBan|Preparing to run service
2022-03-24 22:01:32.9059|WARN|IPBan|Starting service
2022-03-24 22:01:32.9059|WARN|IPBan|Running service
2022-03-24 22:01:32.9908|WARN|IPBan|IPBan is free software created and refined over many years.
2022-03-24 22:01:32.9908|WARN|IPBan|Please consider upgrading to the pro version for more advanced functions, shared ban lists and much more.
2022-03-24 22:01:32.9908|WARN|IPBan|Learn more at https://ipban.com
2022-03-24 22:01:32.9908|INFO|IPBan|Initializing IPBan database at Data Source=D:\IPBan-Windows-x64_1_7_1\ipban.sqlite;Cache=Shared;
2022-03-24 22:01:33.2812|WARN|IPBan|IPBan service started and initialized
2022-03-24 22:01:33.2812|WARN|IPBan|Log levels: True,True,True,True,False,False
2022-03-24 22:01:34.9403|INFO|IPBan|Adding log file to parse: C:/Program Files/Microsoft/Exchange Server/*/TransportRoles/Logs/FrontEnd/ProtocolLog/**.log
2022-03-24 22:01:34.9403|INFO|IPBan|Adding log file to parse: C:/Program Files/Smarter Tools/Smarter Mail/**/*.log
2022-03-24 22:01:34.9403|INFO|IPBan|Adding log file to parse: C:/Program Files (x86)/Smarter Tools/Smarter Mail/**/*.log
2022-03-24 22:01:34.9403|INFO|IPBan|Adding log file to parse: C:/SmarterMail/logs/**/*.log
2022-03-24 22:01:34.9403|INFO|IPBan|Adding log file to parse: C:/Smarter Mail/logs/**/*.log
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: C:/Program Files (x86)/Mail Enable/Logging/SMTP/SMTP-Activity-*.log
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: C:/Program Files/Mail Enable/Logging/SMTP/SMTP-Activity-*.log
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: C:/Program Files (x86)/Mail Enable/Logging/IMAP
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: C:/Program Files/Mail Enable/Logging/IMAP
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: C:/Program Files/Tomcat/logs/**/*access_log*.txt
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: /var/log/httpd/access_log
2022-03-24 22:01:34.9493|INFO|IPBan|Adding log file to parse: C:/IPBanCustomLogs/**/*.log
2022-03-24 22:01:35.0084|WARN|IPBan|Loaded firewall type DigitalRuby.IPBanCore.IPBanWindowsFirewall
2022-03-24 22:01:35.0230|WARN|IPBan|Syncing firewall and ipban.sqlite database...
2022-03-24 22:01:35.1570|WARN|IPBan|24 total ip addresses in the ipban.sqlite database
2022-03-24 22:01:35.1834|WARN|IPBan|Initialized event viewer with query string: <QueryList><Query Id='1' Path='Security'><Select Path='Security'>*[System[(band(Keywords,9227875636482146304))]]</Select></Query><Query Id='2' Path='Security'><Select Path='Security'>*[System[(band(Keywords,9227875636482146304))]]</Select></Query><Query Id='3' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='4' Path='Application'><Select Path='Application'>*[System[(band(Keywords,40532396646334464))]]</Select></Query><Query Id='5' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='6' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='7' Path='System'><Select Path='System'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='8' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='9' Path='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational'><Select Path='Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational'>*[System[(band(Keywords,4611686018427387904))]]</Select></Query><Query Id='10' Path='Application'><Select Path='Application'>*[System[(band(Keywords,36028797018963968))]]</Select></Query><Query Id='11' Path='System'><Select Path='System'>*[System[(band(Keywords,36028797018963968))]]</Select></Query></QueryList>
2022-03-24 22:01:35.1834|WARN|IPBan|Ignoring event viewer paths: OpenSSH/Operational,VisualSVNServer
2022-03-24 22:01:35.2315|INFO|IPBan|Config file changed
2022-03-24 22:01:35.2315|INFO|IPBan|FQDN: xxx.local.xxx
2022-03-24 22:01:35.2496|INFO|IPBan|Local ip address: x.x.x.x
2022-03-24 22:01:36.1711|INFO|IPBan|Remote ip address: x.x.x.x
2022-03-24 22:01:37.4345|WARN|IPBan|Updating firewall with 0 entries...
2022-03-24 22:01:37.4345|INFO|IPBan|Firewall entries updated:

I rebooted my server, tried with old versions like 1.6.0, deleted IPBan firewall rules, etc. Now it stops each time at this line even with older versions.

I don't now what happened and also what to do.
Thanks for help !

[jjxtra]

Can you edit nlog.config and change both Info to Debug?

Let me know what you see after that. Just running some tests on my machine and it looks happy.

[jjxtra]

If it helps, I did change some default log levels, so that may be why there is less spam in the console...

[jjxtra]

You can always try to remote into your own machine with a failed login, let me know if you do that and don't see the failed login in the log

[JohnnySixter]

Finally, it's ok, but it took time before seeing it works.
I ran it @ 2022-03-24 22:01, but the first reaction came @ 2022-03-25 00:43. However this is consistent with the Windows event viewer so I think the reason is that access attempts are now rares.

This night I got only 6 attempts (with 3x tries for each). When I used IPBan for the first time, my server was flooded by constant attempts.
I keep an eye on it but I'm pretty sure IpBan rulez! :)

Sory for this waste of time.