Hi,
 
Thanks for your response.
 
I did as per your instruction and restart fail2ban, but nothing work. Then I change the regex like this.
 
failregex = haproxy.* <HOST> -.*"GET.*http:.* HTTP/.*$
                  haproxy.* <HOST> -.*"GET.*http:.* HTTP/.*$
Now after restart here is the log of fail2ban
 
2013-01-25 20:19:08,361 fail2ban.filter : WARNING Unable to find a corresponding IP address for -
 
Here is the haproxy.log
 
Jan 16 19:17:42 lbfs1 haproxy[63952]: 182.185.155.133 - - [16/Jan/2013:14:17:41 +0000] "GET /index.php?n=http://eatmyfood.hostinginfive.com/pizza.htm HTTP/1.1" 200 7669 "-" "-" 18090 823 "webfarm" "webfarm" "web4" 10 0 0 247 948 "--VN" 482 84 49 25 0 0 0 "-" "-"
 
Best Regards,
 
Umar
 
On Fri, Jan 25, 2013 at 7:24 PM, Fabian Wenk <fabian@wenks.ch> wrote:
Hello Umar

On 16.01.2013 21:03, Umar Draz wrote:
>
> failregex = (?i) lbfs1 haproxy\[\d{1-5}\]: <HOST>
> -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$

Try with something like this:

failregex = haproxy(?:\[\d+\])?: <HOST> -.*"GET.*http:.* HTTP/.*$
            haproxy(?:\[\d+\])?: <HOST> -.*"POST.*http:.* HTTP/.*$

You can create multiple lines in the failregex, see the other
filters for examples. You can test your own rules with the
'fail2ban-regex' tool.


bye
Fabian

------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users



--
Umar Draz
Network Architect