fail2ban regex

Need help? Post your questions here.

Moderator: moderators

fail2ban regex

Postby spiritofjerry » Mon Nov 26, 2018 12:11 am

Anyone willing to share the fail2ban regex they have written to parse the logs for failed hosts? I am quite the novice, and can get everything in the jail.conf set up just fine, but am having trouble with the regex required to get the filter working.

Thank you!
spiritofjerry
 
Posts: 2
Joined: Tue Sep 05, 2017 5:22 pm

Re: fail2ban regex

Postby CoolMojo » Tue Nov 27, 2018 2:42 am

I don't actually monitor my subsonic logs - I monitor the apache logs (I have apache acting as a proxy) - but I *believe* the REGEX is the same:

Code: Select all
failregex = <HOST>.*GET.*(login\.view\?error).* 200


EDIT: Sorry. I'm wrong. It's not the same. Maybe try:

Code: Select all
failregex = *LoginFailureLogger.* [<HOST>]
CoolMojo
 
Posts: 1
Joined: Tue Nov 27, 2018 2:39 am


Return to Help

Who is online

Users browsing this forum: Bing [Bot] and 13 guests