The current fail2ban version 0.9.1 does not have a pre-configured filter for Tomcat. In case anyone needs it, here is a regex that works for me. Note that my application is not expected to have any 404 errors. For a more typical website, consider not using the 1st line of the failregex.
[INCLUDES] [Definition] # 1. match on 40x http status code # 2. URLs should start with a forward slash - (often proxy requests start with http://blahh) # 3. match on http 1.0 - let's not support it, even for search engines failregex = <HOST> - - \[.*\] "GET .* HTTP/1.1" 40\d \d+$ <HOST> - - \[.*\] "GET http <HOST> - - \[.*\] "GET .* HTTP/1.0" ignoreregex =