0

I am building a regex-filter to work with this log file:

[15:20:56|9M]   191.241.67.46 | fordcom2002 | delphina | /login
[15:20:56|9M]   109.167.249.41 | kyler394 | Baseball1 | /login
[15:20:57|9M]   103.112.62.126 | akuztikkaren | docomo | /login
[15:20:57|9M]   110.78.145.107 | rodriguezo59 | sureno150 | /login
[15:20:57|9M]   45.250.226.48 | czesio389 | Czesio12345 | site2.com/login
[15:20:58|9M]   103.112.62.126 | russosm16 | sunset8! | /login
[15:20:58|9M]   185.220.101.130 | slidekick28 | camera76 | /login
[15:20:58|9M]   176.104.52.46 | sarah280868 | pspps3 | site2.com/login
[15:20:58|9M]   191.241.67.46 | jackmckillop | vanilla | /login
[15:20:59|9M]   183.81.152.82 | czuck | Jokel1990 | /login
[15:21:01|9M]   125.160.65.176 | bernd_beinicke | xLOMxkhmrc | site2.com/login
[15:21:01|9M]   103.112.62.126 | tyler_harmon256 | Freddy1 | /login
[15:21:02|9M]   186.248.109.30 | poutney-01 | seriously! | site2.com/login
[15:21:02|9M]   186.248.109.30 | okjjli | chamber1 | site2.com/login
[15:21:02|9M]   186.248.109.30 | nacunic | 82925925n | site2.com/login
[15:21:02|9M]   51.79.53.139 | ishman99 | 120899 | /login
[15:21:03|9M]   113.160.219.210 | walter.raponi | patatina | /login
[15:21:03|9M]   117.103.87.62 | sho10004 | biller62 | /login
[15:21:03|9M]   45.225.47.210 | popopopo1234 | pokemon1 | site2.com/login
[15:21:03|9M]   191.241.67.46 | asharanae | beyonce11 | /login
[15:21:03|9M]   117.103.87.62 | javajoewheaton | 5262628 | /login

i tried dozens of regex patterns but they're not working. just like this one:

$ fail2ban-regex "[14:33:39|9M] 110.77.232.21 | miss-sexi-99 | lachat09 | /login" '\[.*\]+\s+<HOST>+$'

but it never works, i always get 'missed'

Running tests
=============

Use   failregex line : \[.*\]+\s+<HOST>+$
Use      single line : [14:33:39|9M]        110.77.232.21 | miss-sexi-99 ...


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:

Lines: 1 lines, 0 ignored, 0 matched, 1 missed
[processed in 0.00 sec]

|- Missed line(s):
|  [14:33:39|9M]        110.77.232.21 | miss-sexi-99 | lachat09 | /login
`-

1 Answer 1

0

This one works with a regex-tester like freeformatter

^\[.*\]\s+(?<HOST>.*)\s+

This uses a named capture "(?<HOST>.*)", which for fail2ban-regex should be replaced simply by "<HOST>", if I read the documentation correctly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .