A number of the filters that come with fail2ban have a _daemon directive, but there is no mention of it in the documentation and no reference to it in any of my jail definitions.
What's it for?
A number of the filters that come with fail2ban have a _daemon directive, but there is no mention of it in the documentation and no reference to it in any of my jail definitions.
What's it for?
The daemon directive is used to construct the __prefix_line regular expression that many of these filters use.
It allows the filter to ignore lines that come from other services, but may otherwise match your regular expression.
You can see references to _daemon in the filter.d/common.conf file.