When fail2ban adds logfiles to follow it does not account for symlinks. For example, the following output when reloading fail2ban shows logs being added. There is in fact only one error_log on this server, but users have symlinked ~/www -> /var/www as a shortcut.
Added logfile = /home/james/www/log/error_log
Added logfile = /home/jay/www/log/error_log
Added logfile = /home/q/www/log/error_log
Added logfile = /home/jason/www/log/error_log
Added logfile = /var/www/log/error_log
I'm concerned this might cause problems or at least use unnecessary resources. It would be clever to check the inode of a logfile to ensure it wasn't yet in the stack.