I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts.

I have my Apache2 logfiles located in subdirectories, one per localhost, e.g. '/var/log/apache2/vwww_example_vhost_com/ and logfiles under that as error.log or access.log (or ssl_error.log and ssl_access.log).

The main apache2 logfiles (for localhost and default) are in /var/log/apache2.

Ideally I'd like to be able to wildcard the subdirectory and have fail2ban read in any logfiles under that subdirectory.

The jail.local manpage indicates that in order to specify multiple logfiles you must put a newline and whitespace between each logfile. This does not appear to work with wildcarded directories.

Here's the default config for one of the jails:

port     = http,https
logpath  = %(apache_error_log)s
enabled  = true

Currently I have tried:

port     = http,https
logpath  = %(apache_error_log)s
enabled  = true

With the secondary logfile path on a newline with leading whitespace. This errors and service fail2ban restart fails with a cryptic (and useless) error message.

This fails:

port     = http,https
logpath  = /var/log/apache2/*/*error.log
enabled  = true

Trying to override the %(apache_error_log)s variable in /etc/fail2ban/paths-overrides.local also fails:

apache_error_log = /var/log/apache2/*error.log

apache_access_log = /var/log/apache2/*access.log

Specifying the logfile masks with a space gives me 'head or tail' error in /var/log/fail2ban.log but the service will launch. However, it's not using the logfiles at all then. Separating the logfile masks with a semicolon stops fail2ban from restarting.

My conclusion is that I'm going to have to manually define the directory names for the virtualhosts in jail.local but I haven't found anything that specifically says you can't use a wildcarded subdirectory.

Does anyone have insight on this or a workaround?

Edit: I just tried specifying multiple logfile directories (with the directory name spelled out) and with the same wildcarded filename masks in paths-overrides.local and that is also causing fail2ban not to start.

  • 2
    It might help if you showed us the actual error messages. – Iain Jan 13 '16 at 17:42

It appears so far, that the directory glob doesn't have any effect.

The only solution I found was to create a separate entry for each subdirectory.

Each of my virtual hosts has their respective error/access logs in a subdirectory of /var/log/httpd.

To get the list of error logs (for example), I used:

(ls -F /var/log/httpd/ | awk '/\// {print "/var/log/httpd/"$1"*error.log"}') | \
while read line; do \
    sed -i "/apache_error_log/a \\\t$line" /etc/fail2ban/paths-overrides.local ;

And, of course, repeated the same command, changing 'error' to 'access'.

(ls -F /var/log/httpd/ | awk '/\// {print "/var/log/httpd/"$1"*access.log"}') | \
while read line; do \
    sed -i "/apache_access_log/a \\\t$line" /etc/fail2ban/paths-overrides.local ;

Checking in on fail2ban, the file lists show up as expected

# fail2ban-client status apache-auth
Status for the jail: apache-auth
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 0
|  `- File list:    /var/log/httpd/error_log /var/log/httpd/myvhost/error_log
`- Actions
   |- Currently banned: 0
   |- Total banned: 0
   `- Banned IP list:   

Not exactly what you were looking for, perhaps, but I hope that helps.

~ Kraylo Adaraan

  • Could you explain how this is used in context? For example, for me, this returns a list of entries like "/var/log/httpd/domains/subdomain1/*error.log", but the $1 variable isn't being substituted correctly so nothing gets written to the overrides file. – Chris Woods Sep 3 '18 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.