Note that fail2ban depends on the order of the audit fields

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-23 19:42:53 +00:00
1 changed files with 3 additions and 0 deletions
@@ -6,6 +6,9 @@ def audit(event, actor=None, target=None, **fields):
    Logs a security relevant event as one line with the message "audit". actor is the
    acting user, None for anonymous requests. target is the affected user, if any.
    """
+    # The order of the first fields is fixed: fail2ban matches
+    # 'audit event=… actor_user_id=… actor_email=… ip="<HOST>"' (filter max.conf on the VPS).
+    # Change the filter when changing the order or the names.
    values = dict(
        event=event,
        actor_user_id=actor.id if actor is not None else None,