On Monday, January 6, 2020 2:10:42 PM CST James Moe via Fail2ban-users wrote: > Would this work as well? > > ^.* Disconnected \(no auth attempts .* rip=<HOST>, .*$ > ^.* Aborted \(auth failed .* rip=<HOST>, .*$
Thanks for the suggestion. Unless I'm misreading the failban-regex results (that I posted in my initial message) the regexes are working ok. The problem appears to be that the aggressive regex is being selected, and I could use some help figuring out why and how to stop that. -- Courtney Rosenthal / c...@crosenthal.com / 512-573-5174 _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
