Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I needed some help to create a regular expression for failregex to find and ban the source ip (ex. SRC=192.168.0.1 and ban the IP 192.168.0.1) from this log:

[ATT] Suspect: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.0.1 DST=192.168.0.100 LEN=37 TOS=0x00 PREC=0x00 TTL=13 ID=56037 PROTO=TCP SPT=21 DPT=35 LEN=60

Thanks in advance

share|improve this question

closed as not constructive by mdpc, John Gardeniers, Ward, Scott Pack, sysadmin1138 Nov 14 '12 at 3:07

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

Assuming that the [ATT] Suspect: part indicates that you want to match this entry:

^\[ATT\] Suspect: .*SRC=<HOST>
share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.