是否可以配置我的fail2ban jail.conf来检查docker日志,而不是将日志安装在主机中.例如,将logpath设置为容器日志的路径.
Jail.conf:
...
#example
[nginx-http-auth]
enabled = true
filter = nginx-http-auth
port = http,https
logpath = /var/lib/docker/containers/819564257d4*/*e0923e-json.log
...
但是这没什么用,因为docker logs命令和日志文件之间有一点差别:
# docker logs @nginx_container_name
2016/03/23 12:39:52 [错误] 6#6:*350上游过早关闭连接,同时从上游读取响应头,客户端: @ATTACKER_IP,服务器:@MY_DNS,请求:"GET/Blog/wp-login .php HTTP/1.1",上游:" http://172.17.0.3:8001/Blog/wp-login.php ",主持人:" @ MYY:80 :" @ ATTACKER_IP - - [23/Mar/2016:12: 39:52 +0000]"GET /Blog/wp-login.php HTTP/1.1"502 173" - ""Python-urllib/2.7"
# cat /var/lib/docker/containers/819564257d4*/*e0923e-json.log
{"log":"2016/03/23 12:39:52 [错误] 6#6:*350上游过早关闭连接,同时从上游读取响应头,客户端:@ATTACKER_IP,服务器:@MY_DNS,请求:\" GET /Blog/wp-login.php HTTP/1.1 \",上游:\" http://172.17.0.3:8001/Blog/wp-login.php \",主持人:\" @MY_IP:80 \"\n","stream":"stdout","time":"2016-03-23T12:39:52.219982304Z"} {"log":" @ ATTACKER_IP - - [23/Mar/2016:12:39:52 +0000] \"GET …