Ubuntu Fail2Ban Ban PHP's URL-fopen Apache

Question

I have setup fail2ban on my Ubuntu server and would like to clarify the 'logpath' location to where the jail.conf setting should be pointing to for PHP's URL-fopen ban.

My Ubuntu has a number of websites and all of the websites' access.log files are stored in the /var/www/logs folder. Considering this I changed the path as mentioned to read /var/www/logs/*access.log - With the below settings I assume that fail2ban will monitor each sites access log file and block where needed - am I correct in assuming this?

[php-url-fopen]

enabled = true
port    = http,https
filter  = php-url-fopen
logpath = /var/www/logs/*access.log

Answer 1

With the below settings I assume that fail2ban will monitor each sites

Yes it's correct,

Rules set on /etc/fail2ban/jail.conf are global and therefore affect the entire root folder