I'm trying to run fail2ban on the rsyslog server that gathers auth logs from the rest of our servers. I'm interested on getting notifications working as a first step.
My problem is that fail2ban only triggers on auth.log lines that come from the local machine (the logserver named 'sth-admin-log01'), but not remote servers. For example, 3 occurrences of this line are enough to trigger fail2ban actions:
Mar 27 10:21:28 sth-admin-log01 sshd: Failed password for root from 192.168.1.3 port 34234 ssh2
This line does not trigger anything, no matter how many times it shows up:
Mar 27 11:20:19 test-vm sshd: Failed password for root from 192.168.1.3 port 34631 ssh2
I've tried to verify the (default) sshd.conf filter using fail2ban-regex and it matches both log lines just fine.
I'm using fail2ban 0.8.11-1 on Ubuntu 64bit 18.104.22.168.