108 lines
1.9 KiB
Plaintext
108 lines
1.9 KiB
Plaintext
|
|
[DEFAULT]
|
|
filter = simple
|
|
logpath = /non/exist
|
|
|
|
[emptyaction]
|
|
enabled = true
|
|
filter =
|
|
action =
|
|
|
|
[special]
|
|
failregex = <IP>
|
|
ignoreregex =
|
|
ignoreip =
|
|
|
|
[test-known-interp]
|
|
enabled = true
|
|
filter = test[one=1,two=2]
|
|
failregex = %(known/failregex)s
|
|
failure %(known/_daemon)s %(known/three)s (jail.local) <HOST>
|
|
|
|
[missinglogfiles]
|
|
enabled = true
|
|
journalmatch = _COMM=test ;# allow to switch to systemd (by backend = `auto` and no logs found)
|
|
logpath = /weapons/of/mass/destruction
|
|
|
|
[missinglogfiles_skip]
|
|
enabled = true
|
|
skip_if_nologs = true
|
|
logpath = /weapons/of/mass/destruction
|
|
|
|
[brokenactiondef]
|
|
enabled = true
|
|
action = joho[foo
|
|
|
|
[brokenfilterdef]
|
|
enabled = true
|
|
filter = flt[test
|
|
|
|
[brokenaction]
|
|
enabled = true
|
|
action = brokenaction
|
|
|
|
[missingaction]
|
|
enabled = true
|
|
action = noactionfileforthisaction
|
|
|
|
[missingbitsjail]
|
|
enabled = true
|
|
filter = catchallthebadies
|
|
action = thefunkychickendance
|
|
|
|
[parse_to_end_of_jail.conf]
|
|
enabled = true
|
|
action =
|
|
|
|
[tz_correct]
|
|
enabled = true
|
|
logtimezone = UTC+0200
|
|
|
|
[multi-log]
|
|
enabled = false
|
|
filter =
|
|
logpath = a.log
|
|
b.log
|
|
c.log
|
|
log2nd = %(logpath)s
|
|
d.log
|
|
action = action[actname='ban']
|
|
action[actname='log', logpath="%(log2nd)s"]
|
|
action[actname='test']
|
|
|
|
[sshd-override-flt-opts]
|
|
filter = zzz-sshd-obsolete-multiline[logtype=short]
|
|
backend = systemd
|
|
prefregex = ^Test
|
|
failregex = ^Test unused <ADDR>$
|
|
ignoreregex = ^Test ignore <ADDR>$
|
|
journalmatch = _COMM=test
|
|
maxlines = 2
|
|
usedns = no
|
|
enabled = false
|
|
|
|
[checklogtype_jrnl]
|
|
filter = checklogtype
|
|
backend = systemd
|
|
action = action
|
|
enabled = false
|
|
|
|
[checklogtype_file]
|
|
filter = checklogtype
|
|
backend = polling
|
|
logpath = README.md
|
|
action = action
|
|
enabled = false
|
|
|
|
[checklogtype_test]
|
|
filter = checklogtype_test
|
|
backend = systemd
|
|
action = action
|
|
enabled = false
|
|
|
|
[checklogtype_init]
|
|
filter = checklogtype_test[logtype=init]
|
|
backend = systemd
|
|
action = action
|
|
enabled = false
|