fail2ban/config/action.d/helpers-common.conf

[DEFAULT]

# Usage:
#   _grep_logs_args = 'test'
#   (printf %%b "Log-excerpt contains 'test':\n"; %(_grep_logs)s; printf %%b "Log-excerpt contains 'test':\n") | mail ...
#
_grep_logs = logpath="<logpath>"; grep <grepopts> %(_grep_logs_args)s $logpath | <greplimit>
# options `-wF` used to match only whole words and fixed string (not as pattern)
_grep_logs_args = -wF "<ip>"

# Used for actions, that should not by executed if ticket was restored:
_bypass_if_restored = if [ '<restored>' = '1' ]; then exit 0; fi;

[Init]
greplimit = tail -n <grepmax>
grepmax = 1000
grepopts = -m <grepmax>