I'm trying to find a way to use Fail2Ban in conjunction with my centralized syslogging that NetXMS already does. However, I don't see a way to point Fail2Ban at NetXMS's database and I don't see a way to get NetXMS to save syslog to save to a file so that I can use standard Fail2Ban methods.
why not just use syslog-ng to grab the fail2ban logs and ship them to netxms syslog
Currently everything points at my NetXMS server. I could, I suppose, put in a dst-nat rule above the NetXMS server that redirects all port 514 to a different box that processes it. it's probably something I'd forget while troubleshooting a broken syslog system in the future. :-p