1

Hi so I'm trying to match the following log line:

E/Sun, 04 Mar 2018 21:40:32 +0100: Error logging in from RemoteIP: 1.2.3.4

And after many hours I've finally got a regex that works on debuggerex, regextester, etc. But I cannot for the life of me get fail2ban to match it.

My regex in fail2ban is as follows:

^E\/(Mon|Tue|Wed|Thu|Fri|Sat|Sun), ([0-1][0-9]) (\w\w\w) (\d\d\d\d) (00|[0-9]|1[0-9]|2[0-3]):([0-9]|[0-5][0-9]):([0-9]|[0-5][0-9]) (\+[0-9][0-9][0-9][0-9]): Error logging in from RemoteIP: <HOST>$

Am I missing something basic here or what?

  • I am fairly sure you want to change your logging format, so that it starts with the date part. – anx Mar 4 '18 at 23:36
  • I wouldn't even bother with trying to match the date part. fail2ban tracks the date on its own. Do you get a match using @anx's method below for just "Error logging in from RemoteIP: <HOST>$"? That's the only part you should need for this to be useful with fail2ban. – Paul Gear Mar 5 '18 at 3:46
  • No, I've tried matching just that part with ^Error logging in from RemoteIP: <HOST>$ but that doesn't match either. Is that correct? – ndom91 Mar 5 '18 at 5:51
2

Because i cannot spot your problem, here is the general method of fixing a fail2ban match regex.

  1. Verify your have a file that does contain the desired match, e.g. /var/log/foo.log
  2. Call fail2ban-regex /var/log/foo.log 'substring of regex'
  3. If it does not match, remove a few words from your regex and go to 2.
  4. If it does match, append a few words of your original regex and go to 2, or:
  5. If from 3. and 4. you have pinpointed which word is wrong, fix it.
  6. If after the fix, the full regex still does not match, repeat the whole process with the fixed regex.
  • Thanks for the tips. I've been playing around with fail2ban-regex and not getting a match on the exact log entry I've provided above. I will try to modify the app thats generating the log entry tomorrow when I have some time to conform to your other suggestion and be more "fail2ban friendly" - I will come back with the results then. – ndom91 Mar 4 '18 at 23:46
  • You mean, you dont even get a match if you do the smallest substring, fail2ban-regex foo.log '<HOST>'? – anx Mar 4 '18 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.