# /etc/logrotate.d/fail2ban — replaces the packaged file (weekly, no size cap).
#
# fail2ban logs one line per matched attempt; a flood it cannot block (a jail whose
# ban action is broken, see alpha-call) wrote 6 GB of "already banned" in days
# (2026-10-08). `maxsize` + the hourly /etc/cron.d/alpha-logcap keep it bounded.
/var/log/fail2ban.log {
    su root adm
    daily
    maxsize 200M
    rotate 7
    compress
    delaycompress
    notifempty
    missingok
    postrotate
        fail2ban-client flushlogs 1>/dev/null
    endscript
    create 640 root adm
}
