we do that at work. Found it to painful to make fail2ban to watch to hundreds of vhost log files so we just sniff the requests with ngrep and log them to a file fail2ban watches