fail2ban ignored daily log files

Question

I'm using fail2ban to detect and ban irregular users. This works more or less well, but has one issue with Exim which writes daily log files on my system: The new log file of the next day is simply ignored. Here's my config file:

[exim]
enabled = true
filter = exim
failregex = \[<HOST>\]: 535 Incorrect authentication data
            \[<HOST>\] .* rejected RCPT <.*>: Unknown user$
            \[<HOST>\] .* rejected after DATA: This message scored [0-9.]+ spam points\.$
            \[<HOST>\] sender verify fail for <.*>: Unrouteable address$
            \[<HOST>\] .* rejected RCPT <.*>: relay not permitted$
action = iptables-multiport[name=exim,port="25,465,587"]
logpath = /var/log/exim4/main-*.log

Today I found the program to only watch yesterday's file, with no current bans. I found a number of matching patterns in today's log file. After restarting fail2ban, there were 3 bans active.

The log files are:

• /var/log/exim4/main-20190601.log
• /var/log/exim4/main-20190602.log
• /var/log/exim4/main-20190603.log
• etc.

So the * pattern for logpath clearly isn't very dynamic. I'm wondering what it's good for at all.

Is there any solution to make fail2ban always use today's file?

I'm thinking about restarting the service every night. But it probably only comes up correctly if today's log file was already created, i.e. if any e-mail was processed already. Should I delay the restart by a few minutes? The system would be more "vulnerable" during this delay time.

All in all my impression of fail2ban isn't very good. It just doesn't seem to be very mature or practical or well-thought. But I couldn't find any alternatives that make a better impression. Most of these tools are outdated and have no community.

This is Fail2Ban v0.9.3 of Ubuntu 16.04.

Edit: It's not a duplicate of the other question because the other one only handles multiple static file names, my question is about daily changing file names.

Answer 1

If you can alter exim's log rotation routine I suggest you to create structure below.

These are log of web server but idea is same.

access.log is a symbolic link that always links to today's log file. Program (fail2ban) that has access to access.log doesn't care that it points to just gets the content.

Your exim log rotation needs to unlink access.log from old file and create new link to new log file.

With this way fail2ban will not worry about new files just read the good old access.log all the time.