Why am I seeing [11] Thu, 22 Jun 2023 17:31:41 Failed to execute lua script of event OnExceedUSERPASS.

[DomDis]

I did not add a lau script fr this. I did turn on antihammer

[02] Thu, 22 Jun 2023 17:19:59 (0062227) Failed to exchange the keys.
[02] Thu, 22 Jun 2023 17:19:59 (0062227) Closed session, disconnected from 111.67.194.160
[02] Thu, 22 Jun 2023 17:19:59 (0062228) Connected from 111.67.194.160 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 17:20:01 (0062228) The user admin started SSH authentication.
[01] Thu, 22 Jun 2023 17:20:01 (0062228) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:20:01 (0062228) Closed session, disconnected from 111.67.194.160
[02] Thu, 22 Jun 2023 17:20:01 (0062229) Connected from 111.67.194.160 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 17:20:03 (0062229) The user root started SSH authentication.
[01] Thu, 22 Jun 2023 17:20:03 (0062229) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:20:03 (0062230) Connected from 139.59.212.78 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 17:20:03 (0062229) Closed session, disconnected from 111.67.194.160
[02] Thu, 22 Jun 2023 17:20:04 (0062231) Connected from 111.67.194.160 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 17:20:04 (0062230) The user sean started SSH authentication.
[01] Thu, 22 Jun 2023 17:20:04 (0062230) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:20:04 (0062230) Closed session, disconnected from 139.59.212.78
[01] Thu, 22 Jun 2023 17:20:05 (0062231) The user ubnt started SSH authentication.
[01] Thu, 22 Jun 2023 17:20:05 (0062231) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:20:06 (0062231) Closed session, disconnected from 111.67.194.160
[02] Thu, 22 Jun 2023 17:20:06 (0062232) Connected from 111.67.194.160 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 17:20:07 (0062232) The user ansible started SSH authentication.
[01] Thu, 22 Jun 2023 17:20:08 (0062232) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:20:08 (0062232) Closed session, disconnected from 111.67.194.160
[02] Thu, 22 Jun 2023 17:20:08 (0062233) Connected from 111.67.194.160 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 17:20:10 (0062233) The user root started SSH authentication.
[01] Thu, 22 Jun 2023 17:20:10 (0062233) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:20:10 IP address:111.67.194.160 is blocked for 180 seconds.
[11] Thu, 22 Jun 2023 17:20:10 Failed to execute lua script of event OnExceedUSERPASS.
[02] Thu, 22 Jun 2023 17:20:10 (0062233) Closed session, disconnected from 111.67.194.160
[02] Thu, 22 Jun 2023 17:20:10 (0000000) Closed session, disconnected from 111.67.194.160. The reason is: The IP 111.67.194.160 is banned temporarily.
[02] Thu, 22 Jun 2023 17:20:11 (0000000) Closed session, disconnected from 111.67.194.160. The reason is: The IP 111.67.194.160 is banned temporarily.
[02] Thu, 22 Jun 2023 17:20:12 (0000000) Closed session, disconnected from 111.67.194.160. The reason is: The IP 111.67.194.160 is banned temporarily.
[02] Thu, 22 Jun 2023 17:20:12 (0000000) Closed session, disconnected from 111.67.194.160. The reason is: The IP 111.67.194.160 is banned



[02] Thu, 22 Jun 2023 17:29:46 (0062308) Closed session, disconnected from 68.178.203.196
[02] Thu, 22 Jun 2023 17:29:55 (0062309) Connected from 180.101.88.235 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 17:29:55 (0062310) Connected from 180.101.88.235 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 17:29:57 (0062310) The user root started SSH authentication.
[01] Thu, 22 Jun 2023 17:29:58 (0062310) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 17:29:58 IP address:180.101.88.235 is blocked for 180 seconds.
[11] Thu, 22 Jun 2023 17:29:58 Failed to execute lua script of event OnExceedUSERPASS.
[02] Thu, 22 Jun 2023 17:29:58 (0062310) Closed session, disconnected from 180.101.88.235
[02] Thu, 22 Jun 2023 17:30:19 (0000000) Closed session, disconnected from 180.101.88.235. The reason is: The IP 180.101.88.235 is banned temporarily.

[02] Thu, 22 Jun 2023 18:58:46 (0063067) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063068) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063069) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063070) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063071) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063072) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063073) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063074) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:46 (0063075) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[02] Thu, 22 Jun 2023 18:58:47 (0063076) Connected from 117.160.3.132 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 18:58:47 (0063067) The user oracle started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063068) The user debian started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063071) The user deploy started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063069) The user root started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063072) The user pi started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063074) The user test started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063073) The user admin started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063067) Failed in user/password authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063068) Failed in user/password authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063071) Failed in user/password authentication.
[01] Thu, 22 Jun 2023 18:58:47 (0063069) Failed in user/password authentication.
[01] Thu, 22 Jun 2023 18:58:48 (0063072) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 18:58:48 IP address:117.160.3.132 is blocked for 10800 seconds.
[11] Thu, 22 Jun 2023 18:58:48 Failed to execute lua script of event OnExceedUSERPASS.
[01] Thu, 22 Jun 2023 18:58:48 (0063073) Failed in user/password authentication.
[01] Thu, 22 Jun 2023 18:58:48 (0063074) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 18:58:48 (0063072) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:48 (0063067) Closed session, disconnected from 117.160.3.132
[01] Thu, 22 Jun 2023 18:58:48 (0063070) The user admin started SSH authentication.
[02] Thu, 22 Jun 2023 18:58:48 (0063068) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:48 (0063071) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:48 (0063069) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:48 (0063073) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:48 (0063074) Closed session, disconnected from 117.160.3.132
[01] Thu, 22 Jun 2023 18:58:48 (0063070) Failed in user/password authentication.
[01] Thu, 22 Jun 2023 18:58:48 (0063075) The user wordpress started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:48 (0063076) The user 123456 started SSH authentication.
[01] Thu, 22 Jun 2023 18:58:48 (0063075) Failed in user/password authentication.
[02] Thu, 22 Jun 2023 18:58:48 (0063070) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:48 (0063077) Connected from 108.252.209.104 (local address 172.16.107.47, port 22)
[01] Thu, 22 Jun 2023 18:58:48 (0063076) Failed in user/password authentication.
[11] Thu, 22 Jun 2023 18:58:48 Failed to execute lua script of event OnExceedUSERPASS.
[02] Thu, 22 Jun 2023 18:58:48 (0063076) Closed session, disconnected from 117.160.3.132
[02] Thu, 22 Jun 2023 18:58:49 (0063078) Connected from 47.236.24.180 (local address 172.16.107.47, port 22)
[02

[DomDis]

Oops, I think I did add a lua script.

-- [1] [2] [3] [4] [5] [6]
-- c_SendMail(string strTo,string strSubject,string strPlainText,string strAttach,string strSmtpName,bool bHTML)
-- Parameters
-- [1]string the receiver's email addresses, multiple email addresses can be separated by a comma
-- [2]string mail subject
-- [3]string mail content
-- [4]string attach file path
-- [5]string the smtp configuration name
-- [6]bool mail content is HTML?, true=yes, false=no.
-- Return Values
-- [1]bool return true if email is sent successfully, otherwise return false
--

local user = c_GetUser("%Domain","%Name")
--local user_email = user.note_email
local user_memo = user.note_memo
local event_type = "FTP Event:"
local event_action = "USERPASS Exceeded Warning"

if user_memo == nil or user_memo == "" then
local user_memo = "Domenic.disorbo@gdc.com"
end

--DOESN'T WORK local mSalutation = user_memo:gsub('%s+', ' ')
--DOESN'T WORK local mSendTo = user_memo:gsub('%s+', '')
--DOESN'T WORK local mSalutation = user_memo.gsub(user_memo," ", " ")
--DOESN'T WORK local mSendTo = user_memo.gsub(user_memo," ", "")

local mSendTo = user_memo
local mSalutation = user_memo.gsub(user_memo,",", ", ")

local mDate = os.date("%a, %b %d, %Y %I:%M %p")

--local mSubject = "GDCFTP ".. event_type .. " %Name has experinced a " .. event_action .. " event on %PathName"
local mSubject = "GDCFTP ".. event_type .. " The user '%Name' has experinced a " .. event_action .. " event"

local mBody ="Dear " .. mSalutation .. "\n\n The FTP user %Name from the following IP %IP has just experince a " .. event_type .. " " .. event_action .. " event (" .. mDate .. ") "

local mSMTP = "Big Mountain Mail"


if mSendTo ~= nil and MSendTo ~= "" then
c_SendMail(mSendTo, mSubject, mBody, "", mSMTP)
end

[DomDis]

Reading through some other forum topics I think I see that if a user dos not authenticate then you cant send an email of who was authenticating

So I'm guessing this is where the problem is

local user = c_GetUser("%Domain","%Name")
--local user_email = user.note_email
local user_memo = user.note_memo
local event_type = "FTP Event:"
local event_action = "USERPASS Exceeded Warning"

[DomDis]

I figured it out. I'd delete this post so it doesn't confuse other but I don't know how to delete or edit posts