I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations.
Every day, I archive previous day of logs to another directory, so, aside from 5 minute period, there is only one subdirectory in /var/log/syslog/.
Based on this, I made fail2ban rules using:
logpath = /var/log/syslog/*/auth.log
Which works. Until midnight, where fail2ban still "listens" to previous log. I can reload fail2ban configuration, but this makes me lose existing bans.
So the question is - what can be done to make fail2ban to switch to new log, without losing existing bans?
I also tried to make symlink /var/log/syslog/today, to point to current day logs, and point fail2ban to /var/log/syslog/today/auth.log, but then I got in logs:
Jan 8 00:05:46 xxxx fail2ban.filter : ERROR Unable to open /var/log/syslog/today/auth.log Jan 8 00:05:46 xxxx fail2ban.filter : ERROR [Errno 2] No such file or directory: '/var/log/syslog/today/auth.log' Traceback (most recent call last): File "/usr/share/fail2ban/server/filter.py", line 491, in getFailures has_content = container.open() File "/usr/share/fail2ban/server/filter.py", line 569, in open self.__handler = open(self.__filename) IOError: [Errno 2] No such file or directory: '/var/log/syslog/today/auth.log'
It could be because the auth.log didn't get created until couple of minutes later.
But it any way - fail2ban logged this error coupld of times, and then didn't monitor anything (didn't ban anything)