From Fail2ban
Revision as of 01:04, 3 April 2007 by (Talk) (proper regex for fedora core 5)

Jump to: navigation, search

I had some trouble finding the right regex under Fedora Core 6 (it might works under other FC distro or else), so I thought adding it to the Wiki. I didn't want to be rude by adding it directly to the article but what's the point of discussion if nobody sees it and then comment on it.

Here is my regex again:

\[.+\] \[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$


Thank you. However, didn't this work?

\[.+\] FAIL LOGIN: Client "<HOST>"$

Are you using 0.6.2 or 0.7.x? If you use 0.6.2, could you try this?

\[.+\] FAIL LOGIN: Client "(?P<host>\S+)"$

Thank you --Lostcontrol 21:56, 21 January 2007 (CET)

proper regex for fedora core 5

Hi i tried the one you are asking about:

\[.+\] FAIL LOGIN: Client "<HOST>"$

but it didn't work this is the error in the error log

#failregex = \[.+\] FAIL LOGIN: Client "<HOST>"$
2007-03-29 13:41:03,902 ERROR: Please check the format and your locale settings.
2007-03-29 13:41:05,550 ERROR: time data did not match format:  data=Mar 29 13:34:28  fmt=%b %d %H:%M:%S

am currently trying out the format you have suggested for v0.6.2 since its the one i have and get back to you if it doesn't work I will try the fomat that worked for fc6.