So I am having issues getting Fail2Ban to work with as a custom filter for a web app login. First of all, other filter do work such as NGINX Auth. However, my emails have stopped working, not sure why yet.

These are the failed login attempts in the /var/log/auth.log

Apr  1 11:28:15 user pancake[17973]: Attempt to login as random failed. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1 Safari/601.5.17)

Apr  1 11:28:39 user pancake[17974]: Attempt to login as admin failed. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1 Safari/601.5.17)

My Jail (/etc/fail2ban/jail.local):


enabled  = true

port     = http,https

filter   = pancake

logpath  = /var/log/auth.log

maxretry = 4

My filter (/etc/fail2ban/filter.d/pancak.conf)


# Read common prefixes. If any customizations available -- read them from

# common.local

before = common.conf


_daemon = pancake

failregex = Attempt to login as .* failed. <HOST>$

ignoreregex =

Now when I test by running:

sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/pancake.conf

I get:

Running tests


Use   failregex file : /etc/fail2ban/filter.d/pancake.conf

Use         log file : /var/log/auth.log



Failregex: 0 total

Ignoreregex: 0 total

Date template hits:

|- [# of hits] date format

|  [2708] MONTH Day Hour:Minute:Second


Lines: 2708 lines, 0 ignored, 0 matched, 2708 missed

I have also tried using:

failregex = ^%(__prefix_line)sAttempt to login as .* failed. <HOST>$

Any help would be great.

Thanks Trent

  • Why are you using an end-of-line ($) in the regex while there is no end-of-line at that point in the log file auth.log (but rather the parenthesis containing the user agent etc.)? – Marki Apr 10 '16 at 14:42
  • @Marki Hey yep this fixed it however, now it's not banning it after failed attempts. This is the same problem I am having with my Wordpress (WP Fail2ban - plugin) logs work, fail2ban-regex works however no banning is working. I am assuming this to be something with the action. But I'm new to fail2ban and am learning it. Cheers – Trent Apr 10 '16 at 22:44
  • disregard my last. I restarted fail2ban and all good. Thanks – Trent Apr 10 '16 at 23:47
  • You would have had to ask a new question anyways as noone here is looking in comments for new questions. – Marki Apr 11 '16 at 10:29

Remove the $ from the regex as in the log there is no end of line at that point.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.