So i am trying to rate limit POST requests on my server. I have looked around and tried every permutation of strings that i can find on the internet.
this is my jail.local apache conf
[apache-postUsHttp]
enabled = true
port = http,https
filter = apache-postflood
logpath = /var/log/apache2/other_vhosts_access.log
findtime = 30
bantime = 3600
maxretry = 10
and here you have the apache-postflood.conf filter
# Fail2Ban configuration file
#
#
# $Revision: 1 $
#
[Definition]
# Option: failregex
# Notes.: Regexp to catch known spambots and software alike. Please verify
# that it is your intent to block IPs which were driven by
# abovementioned bots.
# Values: TEXT
#
failregex = ^<HOST>.*"POST.*
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
here is an example access post log.
my.tld:80 x.x.x.x - - [25/Aug/2016:05:53:52 -0400] "POST /location/of/file.php HTTP/1.1" 302 300 "http://my.tld/" "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_4 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13G35 Safari/601.1"
i ahve also tried the following failregex = ^ -.* "POST.*
and a lot of other slight variations. but no matter what i do i get no filter notices / infos in my fail2ban logs.
i know that the timespamps are parsing and that it is reading the log, because when i turn on debug loggin it is definately loggin it all.