Can I use regex in fail2ban logpath?

Question

I am using CETNOS 7,yum install fail2ban,in /etc/fail2ban/jail.local,I want to set:

[DEFAULT]
apache_error_log = /var/log/httpd/*error_log
/home/websites/.*?/log/errorlog

to express:

    [DEFAULT]
    apache_error_log = /var/log/httpd/*error_log
    /home/websites/site1/log/errorlog
    /home/websites/site2/log/errorlog

Then,I can use %(apache_error_log)s in /etc/fail2ban/jail.local as below:

[apache-noscript]

port     = http,https
logpath  = %(apache_error_log)s

Is this OK?

score 3 · Accepted Answer · answered Oct 12 '18 at 14:23

3

Fail2Ban logpath doesn't use regular expressions but glob Unix filename pattern matching.

jail.conf (5), logpath

filename(s) of the log files to be monitored, separated by new lines. Globs -- paths containing * and ? or [0-9] -- can be used however only the files that exist at start up matching this glob pattern will be considered.

Rules:

* matches any number of any characters (including none)
? matches any single character
[abc] matches one of the listed characters
[a-z] matches one character in a (locale-dependent) character range
inside the brackets, ! can be used for negation (POSIX systems)
path separator characters i.e. / are never matched.

Therefore, /home/websites/*/log/errorlog will do.

answered Oct 12 '18 at 14:23

Esa Jokinen

49,773

can I add tail after /home/websites/*/log/errorlog? – kittygirl Oct 12 '18 at 15:16
You can't: logpath only takes paths to log files to search. Fail2Ban handles reading the files internally, not through a pipe. – Esa Jokinen Oct 12 '18 at 17:19
see https://websavers.ca/improve-fail2ban-io-performance – kittygirl Oct 12 '18 at 17:38
Oh, there's such an option, too! It just has the same name as the command. Then, sure you should be able to use it. – Esa Jokinen Oct 12 '18 at 17:45
If I add tail,fail2ban can only read 10 lines log.Will that cause findtime invalid? – kittygirl Oct 13 '18 at 02:27
That's only when it starts. When new logs starts to build, Fail2Ban aren't limited to 10 lines anymore. Consider using tail if the log files are huge, making the Fail2Ban startup slow. – Esa Jokinen Oct 13 '18 at 02:30

Can I use regex in fail2ban logpath?

1 Answers1