DOC: Add items to ChangeLog and readded jail.conf(5) for logpath tail

jail.conf change merged from 6a395f4cf7
11 years ago · 725a8261fe
2 changed files with 8 additions and 1 deletions
--- a/5
+++ b/5
@ -43,6 +43,10 @@ configuration before relying on it.
     support these. ISO8601 now defaults to localtime unless specified otherwise.
     Some filters have been change as required to capture these elements in the
     right timezone correctly.
+   * Log levels are now set by Syslog style strings e.g. DEBUG, ERROR.
+     - Log level INFO is now more verbose
+   * Optionally can read log files starting from "head" or "tail".
+     - See "logpath" option in jail.conf(5) man page.

 - New features:
   * [..c7ae460] Multiline failregex. Close gh-54
@ -62,6 +66,7 @@ configuration before relying on it.
     Close gh-347
   * Filter for squirrelmail. Close gh-261
   * Filter for tine20. Close gh-583
+   * Custom date formats (strptime) can now be set in filters and jail.conf

 - Enhancements
   * Jail names increased to 26 characters and iptables prefix reduced
--- a/man/jail.conf.5
+++ b/man/jail.conf.5
@ -129,7 +129,9 @@ The following options are applicable to any jail. They appear in a section speci
 name of the filter -- filename of the filter in /etc/fail2ban/filter.d/ without the .conf/.local extension. Only one filter can be specified.
 .TP
 .B logpath
-filename(s) of the log files to be monitored. Globs -- paths containing * and ? or [0-9] -- can be used however only the files that exist at start up matching this glob pattern will be considered.
+filename(s) of the log files to be monitored, seperate by new lines. Globs -- paths containing * and ? or [0-9] -- can be used however only the files that exist at start up matching this glob pattern will be considered.
+
+Optional space separated option 'tail' can be added to the end of the path to cause the log file to be read from the end, else default 'head' option reads file from the beginning

 Ensure syslog or the program that generates the log file isn't configured to compress repeated log messages to "\fI*last message repeated 5 time*s\fR" otherwise it will fail to detect. This is called \fIRepeatedMsgReduction\fR in rsyslog and should be \fIOff\fR.
 .TP