We are running fail2ban on webservers that are monitoring several log files of individual vhosts in one action.
Files are named /var/log/ols/domain.com.access.log
The jail.local looks like this:
[wordpress-wp-login]
enabled = true
port = http,https
filter = wordpress-wp-login
logpath = /var/log/ols/*access.log
maxretry = 5
bantime = 1200
ignoreip =
I need to know which log file the jail is being triggered for in the action.
We know that if we changed the log file fields we could pass through for example %v from LiteSpeed (or $http_host for nginx) - however our hosting provider is not able to persist these changes for us for the foreseeable future.
Is it possible to pass through the path of the monitored logfile into the action as a variable?
e.g.
actionban = < LogFilePath >