fail2ban regex

Need help? Post your questions here.

Moderator: moderators

fail2ban regex

Postby spiritofjerry » Mon Nov 26, 2018 12:11 am

Anyone willing to share the fail2ban regex they have written to parse the logs for failed hosts? I am quite the novice, and can get everything in the jail.conf set up just fine, but am having trouble with the regex required to get the filter working.

Thank you!
Posts: 2
Joined: Tue Sep 05, 2017 5:22 pm

Re: fail2ban regex

Postby CoolMojo » Tue Nov 27, 2018 2:42 am

I don't actually monitor my subsonic logs - I monitor the apache logs (I have apache acting as a proxy) - but I *believe* the REGEX is the same:

Code: Select all
failregex = <HOST>.*GET.*(login\.view\?error).* 200

EDIT: Sorry. I'm wrong. It's not the same. Maybe try:

Code: Select all
failregex = *LoginFailureLogger.* [<HOST>]
Posts: 1
Joined: Tue Nov 27, 2018 2:39 am

Return to Help

Who is online

Users browsing this forum: No registered users and 3 guests