From: Marco M. <mm...@do...> - 2024-05-10 11:07:34
|
Hello! I've a listserv log that should be checked by fail2ban. The lines begin with 10 May 2024 09:16:18 This isn't being auto-detected by f2b. I've tried the following regex. datepattern = %%d\s%%b\s%%Y\s%%H:%%M:%%S I've also tried it with spaces instead of \s. Both give me python tracebacks. What is the proper way to diagnose the issue in the datepattern regex? -- kind regards Marco |
From: Marco M. <mm...@do...> - 2024-05-13 13:01:27
|
Am 10.05.2024 um 09:29:39 Uhr schrieb Steve Newcomb: > % python3 -c "import re; print( re.compile( r'^[0-3][0-9][ > \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][ > \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 > 09:16:18'))" It only works by using \ at the end. m@ryz:~$ python3 -c "import re; print( re.compile( r'^[0-3][0-9][\ \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][\ \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 09:16:18'))" None m@ryz:~$ What does that mean? For me it looks like the regex doesn't match. |
From: Steve N. <sr...@co...> - 2024-05-13 13:35:43
|
The line breaks you found (or perhaps created) are spurious artifacts. The backslashes that you added at the ends of the broken lines fix the spurious-linebreaks problem by telling your shell (bash?) to ignore them. Another way around the problem is to remove the spurious line breaks so they don't confuse your shell. Of course, that would make the command line very long indeed, but it *is* a very long line, regardless of whether you escape some inserted line breaks. On 5/13/24 09:01, Marco Moock wrote: > Am 10.05.2024 um 09:29:39 Uhr schrieb Steve Newcomb: > >> % python3 -c "import re; print( re.compile( r'^[0-3][0-9][ >> \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][ >> \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 >> 09:16:18'))" > It only works by using \ at the end. > m@ryz:~$ python3 -c "import re; print( re.compile( r'^[0-3][0-9][\ > \t]+[A-Z][a-z]{2}[ \t]+20[23][0-9][\ > \t]+[0-2][0-9]:[0-5][0-9]:[0-5][0-9]').search( '10 May 2024 09:16:18'))" > None > m@ryz:~$ > > What does that mean? > For me it looks like the regex doesn't match. |