33

How can I configure multiple logpaths for the same rule?

I'm trying to write a syntax like this:

[apache-w00tw00t]
enabled  = true
filter   = apache-w00tw00t
action   = iptables-allports
logpath  = /var/log/apache*/*error.log 
logpath  = /var/www/vhosts/site1.com/log/errorlog 
logpath  = /var/www/vhosts/site1.com/subdom/log/errorlog
logpath  = /var/www/vhosts/site3/log/errorlog
logpath  = /var/www/vhosts/site4/log/errorlog
maxretry = 1

The paths are all different, so I can not use the RE *

What is the correct syntax to put more logs to a rule?

1 Answer 1

33

I tried using the same syntax and got no errors when launching fail2ban. Try this in your jail.conf and if nevertheless it doesn't work you can easily split your rule in several ones with a single logpath, ex.:

[apache-w00tw00t-1]
enabled  = true
filter   = apache-w00tw00t
action   = iptables-allports
logpath  = /var/log/apache*/*error.log 
maxretry = 1

[apache-w00tw00t-2]
enabled  = true
filter   = apache-w00tw00t
action   = iptables-allports
logpath  = /var/www/vhosts/site1.com/log/errorlog 
maxretry = 1

etc.

This should finally work:

[apache-w00tw00t]
enabled  = true
filter   = apache-w00tw00t
action   = iptables-allports
logpath  = /var/www/vhosts/site1.com/log/errorlog
           /var/log/apache*/*error.log
           /var/www/vhosts/site1.com/subdom/log/errorlog
           /var/www/vhosts/site3/log/errorlog
           /var/www/vhosts/site4/log/errorlog  
maxretry = 1

You can consult http://centoshelp.org/security/fail2ban/ for information.

7
  • my code does not show errors, but does not work as expected. Fail2ban sees only one log rule. Your solution is that for every rule I have to create a file in / filter.d? example [apache-w00tw00t-1] / etc/fail2ban/filter.d/apache-w00tw00t-1.conf [apache-w00tw00t-2] / etc/fail2ban/filter.d/apache-w00tw00t-2.conf etc.
    – Max121
    Mar 9, 2013 at 22:04
  • Yes, I mean that. Mar 9, 2013 at 22:05
  • If you mean this is interesting, but it is not the best solution I think, would create many duplicates with the same rules. I think there is a more elegant solution to merge multiple logs into a rule In any case, thank you for the collaboration.
    – Max121
    Mar 9, 2013 at 22:12
  • Please, check my editions in my answer above. Looking forward to your results. Mar 9, 2013 at 22:22
  • 4
    The 2nd part of your answer works perfect if you give "tab" spacing for the extra logs. If there is no "tab" fail2ban throws error. May 25, 2016 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .