0

This is the failregex

^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"


log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)?

This is the line in my logfile that the above failregex should match but doesn't when I run it through fail2ban-regex.

[2015-12-07 06:20:35] SECURITY[1231] res_security_log.c: SecurityEvent="FailedACL",EventTV="1449498035-843882",Severity="Error",Service="AMI",EventVersion="1",AccountID="admin",SessionID="0x9f93d24",LocalAddress="IPV4/TCP/0.0.0.0/5038",RemoteAddress="IPV4/TCP/217.23.7.173/37756",SessionTV="0-0"
  • So did you establish first whether the regex is faulty or fail2ban? – Willem Dec 12 '15 at 0:41
  • I can make the failregex work by removing a bunch of stuff in the middle. I am assuming it is the regex that is at fault. – Fred Flint Dec 13 '15 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.