I am configuring fail2ban on my webservers. My Webservers are behind ELB. so I configured X-forwarded to get the real IP's in Apache Access logs.But unfortunately fail2ban not able scan accesslogs when x-forwarded is enabled in access logs.This is my regress condition
failregex = ^<HOST> -.*\"(GET|POST).*
And bellow is my logformat when x-forwarded enabled
10.0.2.18 (220.127.116.11) - - [01/May/2014:16:05:39 +0000] "GET / HTTP/1.1" 304 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/537.75.14"