After noticing repeated attempts to access supposed webadmin resources on my server in blocks by the same ips (i.e. repeated attempts from each ip in a long list of 'common' server webadmin resources, e.g. /phpmyadmin, /mysql, etc.), I've set up a custom fail2ban filter (and jail) which tested successfully in fail2ban-regex against my apache2/access.log, showing 55 'hits' (seems about right without checking):
before = apache-common.conf
failregex = '^<HOST> - - .*"GET \/phpmyadmin|"GET \/phpMyAdmin|"GET \/pma\/|"GET \/myadmin|"GET \/admin|"GET \/mysql.*$'
ignoreregex = ''
The fail2ban.log shows the new jail loaded. However, none of several offending ips in the current apache2/access.log is listed in the fail2ban.log after restart.
My understanding of f2b is that it bans against current logs without waiting for new log entries.
Does this indicate the new filter and jail aren't working as intended?