Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using wildcard in the logpath value as shown below:

enabled = true
filter = http-get-dos
logpath = /var/log/ispconfig/httpd/*/access.log
maxretry = 250
findtime = 300
#ban for 10 hours
bantime = 36000
action = iptables-multiport[name=HTTP, port="http,https", protocol=tcp]

This works great but I want to exclude specific log because I need to create a separate filter for this.

So, for example, if I want to exclude /var/log/ispconfig/httpd/, how do I do this?

share|improve this question
I am not sure what you are trying to do but logpath = /var/log/ispconfig/httpd/!( might be an option. – val0x00ff Jul 24 '13 at 12:31
As I've said I will create a separate filter. like another [http-get-dos2]. I tested your suggestion but it still it add to logpath as fail2ban.log stated as follows Added logfile = /var/log/ispconfig/httpd/ – jaYPabs Jul 24 '13 at 12:46
If you can use globs * you will be able to use ! negate too. Did you restart fail2ban / iptables. – val0x00ff Jul 24 '13 at 12:54
Yes, I already restarted fail2ban. – jaYPabs Jul 24 '13 at 13:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.