Given the apparent addiction fail2ban keeps finding to the existing logfile - not looking at the *new* one once logrotate runs - I was putting a hack into place in /etc/logrotate.d/syslog. Nothing I find is perfectly clear: I want to restart fail2ban *after* the logs are rotated. Do I put the /sbin/service fail2ban restart after endscript, or do I add a lastaction after endscipt, and put it after *that*? mark