Default profile bans 3 failures in 10 minutes for 24 hours, with repeat
offenders (3 bans in a day) banned for a week. The sshd jail reads the
journal, the recidive jail reads fail2ban's own log file.
The recidive jail can only count bans in a file, so the script resolves
the effective logtarget from fail2ban.conf, fail2ban.d/*.conf and
fail2ban.local, refuses a non-file target, and verifies the file really
receives output before reporting success.
ecss