Fail2ban regex doesn't match my log

Question

I'm trying to create a failregex in Fail2ban to find these lines ( and IP addresses ), but I can't write it.

My log lines looks like these:

[Thu Sep 22 10:28:32.215159 2016] [:error] [pid 1616] [client 83.143.240.13:54895] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php

[Thu Sep 22 04:38:01.588441 2016] [:error] [pid 24937] [client 49.151.91.8:58121] FastCGI: server "/var/www/cgi-bin/php5-fcgi-104.236.209.45-80-blogginger.com" stderr: PHP message: WP login failed for username: admin, referer: http://blogginger.com/wp-login.php

And this is my failregex line in attack.conf:

failregex = [[]client <HOST>[]] WP login failed.*

But it doesn't work. There is not any match.

What is the correct failregex line for find these log lines?

Thank you!

Answer 1

Try

failregex = \[client <HOST>:\d+\] .* WP login failed

You can use the fail2ban-regex utility to test regexes against example input files. That's a lot quicker and easier than trying to do this with the live logs.

Answer 2

try with

failregex = [[]client <HOST>[]] .*WP login failed.*