About dynamic logfilename

[albenard]

Hi,
i would like to use fail2ban with a filter for postgresql and datepattern , failregex are ok and it's ok for the logs files who exist in directory.
[postgresql]
enabled = true
port = 5432
filter = postgresql
logpath = /data/log/postgresql-*.log
maxretry = 5
bantime = 3600

Each day postgres create a new file for log with this pattern : 'postgresql-%Y-%m-%d_%H%M%S.log'

fail2ban does not detect the new file unless I restart the service of course. So i can use cron for programming a restart but I would like if there is a way for forcing fail2ban to detect the new(s) file(s). For example it woulld be nice to have a parameter like bantime, for example analysetime. I think there is a low cost just for analysing if there is a new file. idealy 2 parameters analysetime = 00:05:00 (fix analyse) and delaytime = 15m (recurrent ananlyse). Perhaps there is a way but i don't know.
Thanks for your response.

[sebres]

Each day postgres create a new file for log with this pattern : 'postgresql-%Y-%m-%d_%H%M%S.log'

Normally it'd not do that for current file, only for rotated files (in daily case)...
This way it is justified for windows possibly, but not for linux where every distro has a proper central mechanism for log-rotation.

So i can use cron for programming a restart

It is not advisable to do that.

but I would like if there is a way for forcing fail2ban to detect the new(s) file(s).

One can use reload ?jail? (which would read the config and built a new config stream, so it'd contain:

set jail dellogpath '/old/path/to/log'
set jail addlogpath '/new/path/to/log'

(and one could simply use this 2 command directly instead of reload, but...)

But also that is not advisable.

Better ways:

• switch to "normal" rotation (only rotated files renamed to something "dated", current file is always accessible with the same name)
• if not possible for some reason, create a link with always constant path (either in postrotate callback or if impossible too via cron).
• switch to systemd journal instead of logfile