Re: [Fail2ban-users] Help needed with regex

[James M. <moe...@sm...>]

On 10/19/23 4:49 AM, Marcel Blenkers wrote:
> The Logfile looks like this:
> Oct 16 15:49:02 localhost cabc0b82e7f9[424]: 192.168.10.10 - - 
> [16/Oct/2023:13:49:02 +0000] "GET 
> /de_DE/infrastruktu?order=website_priority%2Cname+asc HTTP/1.1" 404 
> 3005 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) 
> Gecko/20100101 Firefox/116.0" "-"

Try this:

fail2reg = ^.* <HOST> .* HTTP/.* (403|404).*


--