logrotate.d設定
# more /etc/logrotate.d/fail2ban
#
# Gentoo:
# http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-analyzer/fail2ban/
files/fail2ban-logrotate?view=markup
#
# Debian:
# https://github.com/fail2ban/fail2ban/blob/debian/debian/fail2ban.logrotate
/var/log/fail2ban.log {
create 0640 root zabbix
missingok
notifempty
postrotate
/usr/bin/fail2ban-client flushlogs >/dev/null || true
endscript
}
# logrotate -v -f /etc/logrotate.d/fail2ban
reading config file /etc/logrotate.d/fail2ban
Reading state from file: /var/lib/logrotate/logrotate.status
Allocating hash table for state file, size 64 entries
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Creating new state
Handling 1 logs
rotating pattern: /var/log/fail2ban.log forced from command line (no old logs will be kept)
empty log files are not rotated, old logs are removed
considering log /var/log/fail2ban.log
Now: 2025-01-29 14:30
Last rotated at 2025-01-26 00:00
log needs rotating
rotating log /var/log/fail2ban.log, log->rotateCount is 0
dateext suffix '-20250129'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/fail2ban.log.1 to /var/log/fail2ban.log.2 (rotatecount 1, logstart 1, i 1),
old log /var/log/fail2ban.log.1 does not exist
renaming /var/log/fail2ban.log.0 to /var/log/fail2ban.log.1 (rotatecount 1, logstart 1, i 0),
old log /var/log/fail2ban.log.0 does not exist
log /var/log/fail2ban.log.2 doesn't exist -- won't try to dispose of it
renaming /var/log/fail2ban.log to /var/log/fail2ban.log.1
disposeName will be /var/log/fail2ban.log.1
creating new /var/log/fail2ban.log mode = 0640 uid = 0 gid = xxx
running postrotate script
removing old log /var/log/fail2ban.log.1
# ls -la /var/log/fail2ban.log*
-rw-rw---- 1 root zabbix 107 Jan 29 14:30 /var/log/fail2ban.log
【参考】
Linux でログファイルをローテートする #Linux – Qiita
zabbixログ監視設定
ホスト→アイテム→アイテム追加→
名前:fail2banログ監視
タイプ:Zabbixエージェント(アクティブ)
キー:log[“/var/log/fail2ban.log”,”recidive”]
