I'm using fail2ban to detect and ban irregular users. This works more or less well, but has one issue with Exim which writes daily log files on my system: The new log file of the next day is simply ignored. Here's my config file:
[exim]
enabled = true
filter = exim
failregex = \[<HOST>\]: 535 Incorrect authentication data
\[<HOST>\] .* rejected RCPT <.*>: Unknown user$
\[<HOST>\] .* rejected after DATA: This message scored [0-9.]+ spam points\.$
\[<HOST>\] sender verify fail for <.*>: Unrouteable address$
\[<HOST>\] .* rejected RCPT <.*>: relay not permitted$
action = iptables-multiport[name=exim,port="25,465,587"]
logpath = /var/log/exim4/main-*.log
Today I found the program to only watch yesterday's file, with no current bans. I found a number of matching patterns in today's log file. After restarting fail2ban, there were 3 bans active.
The log files are:
- /var/log/exim4/main-20190601.log
- /var/log/exim4/main-20190602.log
- /var/log/exim4/main-20190603.log
- etc.
So the *
pattern for logpath
clearly isn't very dynamic. I'm wondering what it's good for at all.
Is there any solution to make fail2ban always use today's file?
I'm thinking about restarting the service every night. But it probably only comes up correctly if today's log file was already created, i.e. if any e-mail was processed already. Should I delay the restart by a few minutes? The system would be more "vulnerable" during this delay time.
All in all my impression of fail2ban isn't very good. It just doesn't seem to be very mature or practical or well-thought. But I couldn't find any alternatives that make a better impression. Most of these tools are outdated and have no community.
This is Fail2Ban v0.9.3 of Ubuntu 16.04.
Edit: It's not a duplicate of the other question because the other one only handles multiple static file names, my question is about daily changing file names.