Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does fail2ban continue to monitor rotated log files?

For example, I have a rule monitoring /var/log/fail2ban.log which is automatically rotated by the system every week (7 days). I want to have a rule that monitors for banned IPs in that log to find repeat offenders that have been banned 5 times in the last 10 days. Is that possible?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes, fail2ban continues to monitor rotated log files. From server/filter.py

439 ##
440 # FileContainer class.
441 #
442 # This class manages a file handler and takes care of log rotation detection.
443 # In order to detect log rotation, the hash (MD5) of the first line of the file
444 # is computed and compared to the previous hash of this line.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.