At present this PR breaks compatibility with RHEL platform where the auth log is `/var/log/secure` not `/var/log/auth.log`. I'd say that's one of the most important checks fail2ban performs