I'm trying to create a failregex in Fail2ban to find these lines ( and IP addresses ), but I can't write it.
My log lines looks like these:
[Thu Sep 22 10:28:32.215159 2016] [:error] [pid 1616] [client 83.143.240.13:54895] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php
[Thu Sep 22 04:38:01.588441 2016] [:error] [pid 24937] [client 49.151.91.8:58121] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php
And this is my failregex line in attack.conf:
failregex = [[]client <HOST>[]] WP login failed.*
But it doesn't work. There is not any match.
What is the correct failregex line for find these log lines?
Thank you!