fail2ban/fail2ban — Issue #14: Provide PID validation facility
Author: yarikoptic
Created: 2011-12-28 02:45:06+00:00
State: open

Just ran into sshguard which has such a nice feature
http://www.sshguard.net/docs/log-validation/
which could be easily implemented in fail2ban for the syslog's which carry pid information which we already match but do not use.

So it would require specification of pidfile for the process (usually under /var/run/**.pid) + logic to monitor for their possible updates upon those services restarts (to avoid re-reading it every time) and that is pretty much it I guess.