how to specify multiple log files pattern in fail2ban jail?

问题

I have log files on my server as follows

vpn_20191007.log
vpn_20191008.log
vpn_20191009.log
vpn_20191010.log
vpn_20191011.log
vpn_20191012.log
vpn_20191013.log
vpn_20191014.log
vpn_20191015.log
vpn_20191016.log

Is it possible to add log files pattern in fail2ban jail config?

    [application]
    enabled  = false
    filter   = example
    action   = iptables
    logpath  = /var/log/vpn_%D.log
    maxretry = 1

回答1:

Well, conditionally it is possible...

Although wildcards are basically allowed at the moment, so :

logpath  = /var/log/vpn_*.log

will do the job, but it is a bit ugly in your case:

fail2ban cumulate the list of files only by start of service, so the list remains obtained in fail2ban (unless it gets reloaded) - this means you should notify fail2ban that the log file name got changed (see https://github.com/fail2ban/fail2ban/issues/1379, the work is in progress).
since only one file will get new messages, the monitoring of other files is unneeded, especially if polling backend is used.

So better create some logrotate rules for that:

in order to rename/compress all previous log-files (to avoid match for obsolete files);
either create hard- or sym-link for last/active file with a fixed name (so fail2ban is always able to find it with the same name, and you'd not need wildcard at all);
or to notify fail2ban to reload the jail if logfile-name got changed
(fail2ban-client reload vpn).

Here is an example for logrotate amendment:

    postrotate
        nfn="/var/log/vpn_$(date +%Y%m%d).log"
        touch "$nfn"
        ln -fs "$nfn" /var/log/vpn.log

来源：https://stackoverflow.com/questions/58408453/how-to-specify-multiple-log-files-pattern-in-fail2ban-jail

标签

fail2ban