Wanna setup a Fail2ban logpath for a particular service? We can help you set it up

Fail2ban logpath lets us determine which logs we wish to monitor. Fail2ban works by getting information from SSH, ProFTP, Apache logs, etc..

At Bobcares, we often get requests from our customers regarding fail2ban as part of our Server Management Services.

Today, let’s discuss logpath in fail2ban and see how our Support Engineers add logpath to monitor logs.

What is Fail2ban logpath?

Fail2ban scans log files and ban IPs. Thus log file plays an important role.

We mention log files using logpath in each rule. The log files use the syntax

logpath = path/of/the/error.log

By default, the log files are analyzed from the beginning of the file. We can use a space separation option to make fail2ban read from the end.

We can also mention multiple log path to monitor multiple log files.

How to configure multiple log file

Recently one of our customers requested us to set up multiple log paths for fail2ban for his Nginx server. Let’s discuss how our Support Engineers configure multiple log path.

On checking the configuration, only the Ngnix default logpath was present in the rule. The customer has multiple domains in the server and he was using a custom error log location for a few domains. Let us discuss how our Support Engineers add multiple entries.

There are two methods to mention multiple logpath. We can either mention it in the same rule or we can mention by creating multiple rules.

Method 1: Single rule

We can mention multiple logs in logpath using tab space.

Vi /etc/fail2ban/jail.conf

[nginx]
enabled = true
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
         /var/www/vhosts/domain1.com/error.log
         /var/www/vhosts/domain2.com/error.log
maxretry = 5

Method 2: Multiple rules

We can create separate rules to monitor each log.

[nginx-1]
enabled = true
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 5

[nginx-2]
enabled = true
filter = nginx-http-auth
logpath = /var/www/vhosts/domain1.com/error.log
maxretry = 5

After making any changes in jail.conf we restart the service to make the rule effective.

Possible error for Fail2ban logpath

Let’s discuss the possible error that can arise when configuring logpath. Also, let’s see how our Support Engineers resolve the error.

Repeated Msg Reduction in rsyslog

The program that generates the log file should not be configured to compress repeated log messages. If the compression is on fail2ban will fail to detect it. So our Support Engineers turn off Repeated Msg Reduction.

vi /etc/rsyslog.conf

Change the entry from on to off

$RepeatedMsgReduction off

Save the file and restart rsyslog service.

service rsyslogs restart

[Need any further assistance with fail2ban – We’ll help you]

Conclusion

In short, we have discussed logpath in fail2ban. Also, we have discussed how our Support Engineers setup multiple logpath with single or multiple rule.