On 2022-02-28 13:02, Sophie wrote:
> Thanks James, but this did not work for me:
>
> # fail2ban-client reload nginx-x00
> 2022-02-28 20:00:11,303 fail2ban [419372]: ERROR NOK:
> ("No failure-id group in '%d/%m/%Y:%H:%M:%S'",)
> No failure-id group in '%d/%m/%Y:%H:%M:%S'
>
Sigh. That is what happens when I trust my memory.
This one should work for the date:
datepattern = "%%d/%%b/%%Y:%%H:%%M:%%S"
----[ test regex ]----
fail2ban-regex --datepattern="%d/%b/%Y:%H:%M:%S" "35.205.35.197 - -
[01/Feb/2022:03:10:28 +0000] >> \"GET / HTTP/1.1\" 200 12778 \"-\"
\"Mozilla/5.0 \(Windows NT 10.0; Win64; >> x64\) AppleWebKit/537.36 \(KHTML,
like Gecko\) Chrome/1.1.1.1/Safari /537.36\": 1 Time\(s\)" "^<HOST> \- \- .*"
Running tests
=============
Use datepattern : %d/%b/%Y:%H:%M:%S : Day/MON/Year:24hour:Minute:Second
Use failregex line : ^<HOST> \- \- .*
Use single line : 35.205.35.197 - - [01/Feb/2022:03:10:28 +0000] >> ...
Results
=======
Failregex: 1 total
|- #) [# of hits] regular expression
| 1) [1] ^<HOST> \- \- .*
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [1] Day/MON/Year:24hour:Minute:Second
`-
Lines: 1 lines, 0 ignored, 1 matched, 0 missed
[processed in 0.00 sec]
----[ end ]----
--
James Moe
moe dot james at sohnen-moe dot com
520.743.3936
Think.
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
