I'm using Ubuntu 15.10 and fail2ban 0.9.3. Apache is set up with a bunch of Apache virtualhosts.
I have my Apache2 logfiles located in subdirectories, one per localhost, e.g.
'/var/log/apache2/vwww_example_vhost_com/ and logfiles under that as
The main apache2 logfiles (for localhost and default) are in
Ideally I'd like to be able to wildcard the subdirectory and have fail2ban read in any logfiles under that subdirectory.
The jail.local manpage indicates that in order to specify multiple logfiles you must put a newline and whitespace between each logfile. This does not appear to work with wildcarded directories.
Here's the default config for one of the jails:
[apache-auth] port = http,https logpath = %(apache_error_log)s enabled = true
Currently I have tried:
[apache-auth] port = http,https logpath = %(apache_error_log)s /var/log/apache2/*/*error.log enabled = true
With the secondary logfile path on a newline with leading whitespace. This errors and
service fail2ban restart fails with a cryptic (and useless) error message.
[apache-auth] port = http,https logpath = /var/log/apache2/*/*error.log enabled = true
Trying to override the
%(apache_error_log)s variable in
/etc/fail2ban/paths-overrides.local also fails:
[DEFAULT] apache_error_log = /var/log/apache2/*error.log /var/log/apache2/*/*error.log apache_access_log = /var/log/apache2/*access.log /var/log/apache2/*/*access.log
Specifying the logfile masks with a space gives me 'head or tail' error in
/var/log/fail2ban.log but the service will launch. However, it's not using the logfiles at all then. Separating the logfile masks with a semicolon stops fail2ban from restarting.
My conclusion is that I'm going to have to manually define the directory names for the virtualhosts in
jail.local but I haven't found anything that specifically says you can't use a wildcarded subdirectory.
Does anyone have insight on this or a workaround?
Edit: I just tried specifying multiple logfile directories (with the directory name spelled out) and with the same wildcarded filename masks in
paths-overrides.local and that is also causing fail2ban not to start.