fail2ban/fail2ban — Issue #30: upon restart look only into the tail of log file up to 'bantime' back
Author: yarikoptic
Created: 2012-01-13 01:27:35+00:00
State: open
Labels: enhancement, wishlish

Source distributions from 0.8.4 until 0.8.6 (exclusive) looked straight into the last line in the logfile, thus ignoring all possible errors back (VCS still had "look at the whole file" upon restart). in 0.8.6 behavior changed to look through whole file banning while encountering matching entries. That is an expensive operation if log files are not rotated frequently. Ideally upon restart f2b should look only in the tail of the file as far back in time as as 'bantime'.

Probably it is ok to just read them in the reversed order.

The easiest and least inefficient implementation could use 'reversed()' while reading whole file into RAM, thus might be prohibitively inefficient. For smarter implementations see

http://stackoverflow.com/questions/2301789/read-a-file-in-reverse-order-using-python/2301867#2301867
http://stackoverflow.com/questions/260273/most-efficient-way-to-search-the-last-x-lines-of-a-file-in-python