logrotate vs facl

fail2ban-t akartam megcsinálni, hogy lássa a homeassistant.

cat /etc/logrotate.d/fail2ban
/var/log.hdd/fail2ban.log {

    weekly
    rotate 4
    compress
    # Do not rotate if empty
    notifempty

    delaycompress
    missingok
    # If fail2ban runs as non-root it still needs to have write access
    # to logfiles.
    # create 640 fail2ban adm
    create 640 root adm
    postrotate
        fail2ban-client flushlogs 1>/dev/null
        /usr/bin/setfacl -m g:homeassistant:rx /var/log.hdd/fail2ban.log
    endscript
}

ez a jelenlegi, de nem adja:

getfacl /var/log.hdd/fail2ban.log
getfacl: Removing leading '/' from absolute path names
# file: var/log.hdd/fail2ban.log
# owner: root
# group: adm
user::rw-
group::r-x
other::---

ötlet?