On 08/05/2021 09:55, Nick Howitt wrote:
On 08/05/2021 09:39, Dan Egli wrote:
On 5/8/2021 2:13 AM, Nick Howitt wrote:
Looking at the output, I think you've quoted the regex in your
/root/test.conf as the "failrexex =" line is different in your two
tests. Remove the quoting.
If only it were that simple. The file isn't quoted. Here's the exact
contents, character for character:
[Definition]
failrexex = .*<HOST>\#.*
ignoreregex =
I assume failrexex is a typo. Do you have an [Includes] section?
BTW I think you are cutting way too much from the posts that they are
impossible to follow.
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
Piecing everything together, hinting out the old posts I get:
test.conf:
[Definition]
failregex = .*<HOST>\#.*
ignoreregex =
test.log:
07-May-2021 00:00:52.925 security: info: client @0x7f2ef8030298
177.237.40.218#80 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN'
denied
07-May-2021 00:00:52.925 security: info: client @0x7f2ef801b528
177.237.40.218#80 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN'
denied
07-May-2021 00:00:52.925 security: info: client @0x7f2ef80104c8
177.237.40.218#80 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN'
denied
test:[
root@server ~]# fail2ban-regex test.log $PWD/test.conf
Running tests
=============
Use failregex file : /root/test.conf
Use log file : test.log
Use encoding : UTF-8
Results
=======
Failregex: 3 total
|- #) [# of hits] regular expression
| 1) [3] .*<HOST>\#.*
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [3] {^LN-BEG}Day(?P<_sep>[-/])MON(?P=_sep)ExYear[
:]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
`-
Lines: 3 lines, 0 ignored, 3 matched, 0 missed
[processed in 0.01 sec]
This is a WFM.
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
