fail2ban regex

[spiritofjerry]

Anyone willing to share the fail2ban regex they have written to parse the logs for failed hosts? I am quite the novice, and can get everything in the jail.conf set up just fine, but am having trouble with the regex required to get the filter working.

Thank you!

[CoolMojo]

I don't actually monitor my subsonic logs - I monitor the apache logs (I have apache acting as a proxy) - but I *believe* the REGEX is the same:

Code: Select all

failregex = <HOST>.*GET.*(login\.view\?error).* 200

EDIT: Sorry. I'm wrong. It's not the same. Maybe try:

Code: Select all

failregex = *LoginFailureLogger.* [<HOST>]