Dear f2b-users, Hoping that his email finds you well,
...please see my comment below. Le ven. 7 mai 2021 07:21, Dan Egli <d...@newideatest.site> a écrit : > Okay, I don't know what I'm doing wrong but apparently I REALLY suck at > writing regular expressions. Hi Dan, ...i found these [1] slides interesting, maybe it could be of interest for a long term perspective :-/ __ [1]: RegEx Syntax Reference & Memo < https://media.libreplanet.org/u/libreplanet/m/workshop-regular-expression-workshop-slides/ > hth Shalom, --sb. I'm trying to create an expression that > would catch these lines: > > 07-May-2021 00:00:52.925 security: info: client @0x7f2ef8030298 > 177.237.40.218#80 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN' > denied > 07-May-2021 00:00:52.925 security: info: client @0x7f2ef801b528 > 177.237.40.218#80 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN' > denied > 07-May-2021 00:00:52.925 security: info: client @0x7f2ef80104c8 > 177.237.40.218#80 (pizzaseo.com): query (cache) 'pizzaseo.com/RRSIG/IN' > denied > > the number after the # can change, obviously. I tried this, but > fail2ban-regex said it missed: > > "security: info: client @0x.* <HOST>#.* (.*): query (cache) .* denied" > > So, how would I correct this regex so that it sees this 177.237.40.218 > idiot? In under 5 minutes he's tried over 16k queries for the same damn > thing. > > -- > Dan Egli > From my Test Server > > _____________________ > [...]
_______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
