Re: [Fail2ban-users] RFC 3339 timestamp

[Yaroslav H. <li...@on...>]

kLe,

doh - RIGHT!

just include a match for .356588+02:00
within failregex right at the beginning just add
\S* and that should be sufficient for now as a workaround I guess ;-)

On Thu, 01 May 2008, Cyril Jaquier wrote:

> Hi all,

> I am really sorry but I am quite busy at work and I had a lot of things
> to do during my free time. But I am still here ;)

> > It needs hacking... I don't see easy workaround by mangling
> > configuration.  if Cyril doesn't pick this problem up I will take
> > care about it... but later... just buzz me if nothing happens within a
> > week

> > my solution would be: allow group specification within a regular
> > expression, if group <time> (or some other name or nameless?) is
> > present, that it is used for matching the date with strptime. Otherwise
> > whole match is used to strip off for regexp matching later on.


> This is what is planned for 0.9 :) I should commit something usable soon
>  in HEAD. failregex will look like this:

> failregex = <TIME> <PREFIX> This is a bad guy: <HOST>

> <PREFIX> will be "auto-detected" as <TIME>. I will include the RFC 3339
> time/date format.

> So be patient ;)

> Cheers,

> Cyril


-- 
                                  .-.
=------------------------------   /v\  ----------------------------=
Keep in touch                    // \\     (yoh@|www.)onerussian.com
Yaroslav Halchenko              /(   )\               ICQ#: 60653192
                   Linux User    ^^-^^    [175555]