If I comment out logpath = /dev/null in the action handler, I get
        Lines containing IP: in <logpath>

I tried specifying multiple log file names in the action handler similar to how logfiles are specified in jail.conf, but only the first logfile was checked.  I expect that additional logic would be required in sendmail-whois-lines.conf to handle multiple log files.  My knowledge of Python is very limited.