Does fail2ban monitor rotated log files?
One can specify multiple logs in one of two ways (or a combination). You can use file globs (wildcards) to match log files to monitor (i.e.logpath = /var/log/*somefile.log
) or a list of logfiles to monitor, separated by whitespace (spaces, tabs, newlines) such as
logpath = /var/log/auth.log /var/log/auth.log.1
or
logpath = /var/log/auth.log
/var/log/auth.log.1
The above answer is incorrect with regards to your question. FileContainer only uses file log rotation detection to reset log reading back to the start of the file instead of the standard procedure of continuing from the last offset:
class FileContainer:
...
def open(self):
self.__handler = open(self.__filename, 'rb')
...
# Compare hash and inode
if self.__hash != myHash or self.__ino != stats.st_ino:
logSys.info("Log rotation detected for %s" % self.__filename)
self.__hash = myHash
self.__ino = stats.st_ino
self.__pos = 0
# Sets the file pointer to the last position.
self.__handler.seek(self.__pos)
There is no code in there that goes looking for rotated files to also parse through.