-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/24/2011 12:14 PM, Mike Wohlgemuth wrote:
I've installed fail2ban on Fedora 15 to block repeated failed ssh connections. It works great up until logrotate kicks in. When it rotates /var/log/secure then fail2ban stops noticing failed ssh attempts. Using fail2ban-client to reload the jail fixes the problem, but it also causes fail2ban to forget all currently banned IP addresses. I've found scripts online that will allow for extracting the current bans before reloading, and then applying them again after, but that seems pretty extreme. I can't help but think I must be missing something simple that will get fail2ban to notice that the logs have been rotated. Has anyone else seeing this issue? I see some reports in bugzilla about fail2ban, but nothing that is definitely this problem.
Thanks Mike
It sounds like fail2ban still has the old log file open. You need to have logrotate tell fail2ban that the log file has changed.
Logrotate already does this will other services when it rotates their log file. I am surprised the .rpm did not include the files for logrotate to automatically sent the proper signal to fail2ban.
Mikkel - --
Do not meddle in the affairs of dragons, for thou art crunchy and taste good with Ketchup!