Hi Tom,
 
Thanks its now worked. Gr8.
 
Best Regards,
 
Umar

On Sat, Jan 26, 2013 at 7:49 PM, Tom Hendrikx <tom@whyscream.net> wrote:
Hi,

Running your attached log excerpt and config file through fail2ban-regex
works here. Please try the same, show us the output and also tell us
your fail2ban version.

So run on the haproxy machine:
- fail2ban-regex haproxy_logs.txt haproxy.conf.txt
- fail2ban-server --version
- fail2ban-client --version

If these commands don't show obvious errors indicting your problem, then
please explain again why it is "not working" with this config: show
errors and such.

--
Tom

On 26-01-13 14:43, Umar Draz wrote:
> HI
>
> Thanks for you response your configuration still not working :(
>
> Well I have attached 3 files.
>
> 1) jail.conf
> 2) haproxy.log
> 3) haproxy.conf filter file
>
> Best Regards,
>
> Umar
> On Sat, Jan 26, 2013 at 5:52 PM, Tom Hendrikx <tom@whyscream.net> wrote:
>
>> Hi Umar,
>>
>> the following works for me with your example line:
>>
>> [Definition]
>> failregex = haproxy\[\d+\]: <HOST> .* "(GET|POST) .*https?://
>>
>>
>> Please try it with fail2ban-regex before using in fail2ban itself. If it
>> stil does not work, lease show your jail.conf for haproxy, and a longer
>> excerpt of your logfile (maybe offlist).
>>
>>
>> On 25-01-13 21:15, Umar Draz wrote:
>>> Hi,
>>>
>>> Thanks for your response.
>>>
>>> I did as per your instruction and restart fail2ban, but nothing work.
>> Then
>>> I change the regex like this.
>>>
>>> failregex = haproxy.* <HOST> -.*"GET.*http:.* HTTP/.*$
>>>                   haproxy.* <HOST> -.*"GET.*http:.* HTTP/.*$
>>> Now after restart here is the log of fail2ban
>>>
>>> 2013-01-25 20:19:08,361 fail2ban.filter : WARNING Unable to find a
>>> corresponding IP address for -
>>>
>>> Here is the haproxy.log
>>>
>>> Jan 16 19:17:42 lbfs1 haproxy[63952]: 182.185.155.133 - -
>>> [16/Jan/2013:14:17:41 +0000] "GET /index.php?n=
>>> http://eatmyfood.hostinginfive.com/pizza.htm HTTP/1.1" 200 7669 "-" "-"
>>> 18090 823 "webfarm" "webfarm" "web4" 10 0 0 247 948 "--VN" 482 84 49 25
>> 0 0
>>> 0 "-" "-"
>>>
>>> Best Regards,
>>>
>>> Umar
>>>
>>> On Fri, Jan 25, 2013 at 7:24 PM, Fabian Wenk <fabian@wenks.ch> wrote:
>>>
>>>> Hello Umar
>>>>
>>>> On 16.01.2013 21:03, Umar Draz wrote:
>>>>>
>>>>> failregex = (?i) lbfs1 haproxy\[\d{1-5}\]: <HOST>
>>>>> -.*"(GET|POST).*\?.*\=http\:\/\/.* HTTP\/.*$
>>>>
>>>> Try with something like this:
>>>>
>>>> failregex = haproxy(?:\[\d+\])?: <HOST> -.*"GET.*http:.* HTTP/.*$
>>>>             haproxy(?:\[\d+\])?: <HOST> -.*"POST.*http:.* HTTP/.*$
>>>>
>>>> You can create multiple lines in the failregex, see the other
>>>> filters for examples. You can test your own rules with the
>>>> 'fail2ban-regex' tool.
>>>>
>>>>
>>>> bye
>>>> Fabian
>>>>
>>>>
>>>>
>> ------------------------------------------------------------------------------
>>>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>>>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>>>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>>>> MVPs and experts. ON SALE this month only -- learn more at:
>>>> http://p.sf.net/sfu/learnnow-d2d
>>>> _______________________________________________
>>>> Fail2ban-users mailing list
>>>> Fail2ban-users@lists.sourceforge.net
>>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>>
>>>
>>>
>>>
>>>
>>>
>>>
>> ------------------------------------------------------------------------------
>>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>>> MVPs and experts. ON SALE this month only -- learn more at:
>>> http://p.sf.net/sfu/learnnow-d2d
>>>
>>>
>>>
>>> _______________________________________________
>>> Fail2ban-users mailing list
>>> Fail2ban-users@lists.sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
>> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
>> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
>> MVPs and experts. ON SALE this month only -- learn more at:
>> http://p.sf.net/sfu/learnnow-d2d
>> _______________________________________________
>> Fail2ban-users mailing list
>> Fail2ban-users@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>>
>
>
>
>
>
> ------------------------------------------------------------------------------
> Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
> with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> MVPs and experts. ON SALE this month only -- learn more at:
> http://p.sf.net/sfu/learnnow-d2d
>
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fail2ban-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>


------------------------------------------------------------------------------
Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
MVC, Windows 8 Apps, JavaScript and much more. Keep your skills current
with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
MVPs and experts. ON SALE this month only -- learn more at:
http://p.sf.net/sfu/learnnow-d2d
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users



--
Umar Draz
Network Architect