3

I am using CETNOS 7,yum install fail2ban,in /etc/fail2ban/jail.local,I want to set:

[DEFAULT]
apache_error_log = /var/log/httpd/*error_log
/home/websites/.*?/log/errorlog  

to express:

    [DEFAULT]
    apache_error_log = /var/log/httpd/*error_log
    /home/websites/site1/log/errorlog
    /home/websites/site2/log/errorlog  

Then,I can use %(apache_error_log)s in /etc/fail2ban/jail.local as below:

[apache-noscript]

port     = http,https
logpath  = %(apache_error_log)s

Is this OK?

2

Fail2Ban logpath doesn't use regular expressions but glob Unix filename pattern matching.

jail.conf (5), logpath

filename(s) of the log files to be monitored, separated by new lines. Globs -- paths containing * and ? or [0-9] -- can be used however only the files that exist at start up matching this glob pattern will be considered.

Rules:

  • * matches any number of any characters (including none)
  • ? matches any single character
  • [abc] matches one of the listed characters
  • [a-z] matches one character in a (locale-dependent) character range
  • inside the brackets, ! can be used for negation (POSIX systems)
  • path separator characters i.e. / are never matched.

Therefore, /home/websites/*/log/errorlog will do.

6
  • can I add tail after /home/websites/*/log/errorlog? – kittygirl Oct 12 '18 at 15:16
  • You can't: logpath only takes paths to log files to search. Fail2Ban handles reading the files internally, not through a pipe. – Esa Jokinen Oct 12 '18 at 17:19
  • Oh, there's such an option, too! It just has the same name as the command. Then, sure you should be able to use it. – Esa Jokinen Oct 12 '18 at 17:45
  • If I add tail,fail2ban can only read 10 lines log.Will that cause findtime invalid? – kittygirl Oct 13 '18 at 2:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.