fail2ban

how to specify multiple log files pattern in fail2ban jail?


I have log files on my server as follows

vpn_20191007.log
vpn_20191008.log
vpn_20191009.log
vpn_20191010.log
vpn_20191011.log
vpn_20191012.log
vpn_20191013.log
vpn_20191014.log
vpn_20191015.log
vpn_20191016.log

Is it possible to add log files pattern in fail2ban jail config?

    [application]
    enabled  = false
    filter   = example
    action   = iptables
    logpath  = /var/log/vpn_%D.log
    maxretry = 1

Solution

  • Well, conditionally it is possible...

    Although wildcards are basically allowed at the moment, so :

    logpath  = /var/log/vpn_*.log
    

    will do the job, but it is a bit ugly in your case:

    So better create some logrotate rules for that:

    Here is an example for logrotate amendment:

        postrotate
            nfn="/var/log/vpn_$(date +%Y%m%d).log"
            touch "$nfn"
            ln -fs "$nfn" /var/log/vpn.log