Re: [Fail2ban-users] Help needed with regex

[John W. <wil...@gm...>]

Here I use,

[Definition]
failregex = ^<HOST>.*"(GET|POST).*" (404|444|403|400) .*$
ignoreregex =

Kind regards,
John Willemse

LinkedIn: https://www.linkedin.com/in/willemsej/
Twitter:    https://twitter.com/willemsej/




Op do 19 okt 2023 om 23:03 schreef James Moe via Fail2ban-users <
fai...@li...>:

> On 10/19/23 4:49 AM, Marcel Blenkers wrote:
> > The Logfile looks like this:
> > Oct 16 15:49:02 localhost cabc0b82e7f9[424]: 192.168.10.10 - -
> > [16/Oct/2023:13:49:02 +0000] "GET
> > /de_DE/infrastruktu?order=website_priority%2Cname+asc HTTP/1.1" 404
> > 3005 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0)
> > Gecko/20100101 Firefox/116.0" "-"
>
> Try this:
>
> fail2reg = ^.* <HOST> .* HTTP/.* (403|404).*
>
>
> --
>
>
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>