both work on their own just fine and fail2ban happily logs to /var/log/fail2ban.log I would like to enable some log monitoring and I can only monitor the syslog file so I thought I could use this directive to make fail2ban log to syslog: Code: logtarget = SYSLOG it works, fail2ban now logs to syslog but if I want to enable the recidive module of fail2ban I need to tell it which log file to monitor and I'd rather avoid monitoring syslog so I was looking to make rsyslog write to /var/log/fail2ban.log I tried these but none really works, it seems I cannot figure out the correct syntax, could someone help out? Code: fail2ban.actions -/var/log/fail2ban.log :msg, contains, "fail2ban.*" /var/log/fail2ban.log if $programname == 'fail2ban.*' then /var/log/fail2ban.log The first one definitely doesn't work, the other two seem to have problems with fail2ban.* - if I remove .* it works. Also, I need to log to fail2ban.log AND syslog Any pointers?