quick question regarding fail2ban filter regex problem I have a log pattern:

2018-02-06 07:40:20,954 fail2ban.actions [26058]: NOTICE [postfix-sasl] Ban

I try to Ban IP ( following filter:

failregex = ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} ([a-z])\w+.([a-z])\w+ [\d]: NOTICE [([a-z])\w+-([a-z])\w+] Ban *

So far no luck. fail2ban-regex listed missing line

I am sure it is a simple error somewhere in the middle.

Any help appreciated

  • 1
    You have already banned this IP address. Banning it again is pointless. – Michael Hampton Feb 11 '18 at 3:17

I'm not sure why you would like to block an IP with fail2ban that has been blocked already with fail2ban, but anyway …

I see two issues why your fail2ban filter does not work.

  1. You don't have a <HOST> tag within your failregex line.

    Replace * at the end of your failregex line by <HOST>. This will tell fail2ban witch part of a log file line represents the IP to ban.

  2. Your regex is not correct.




    ^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} \w+\.\w+ \[.*\]: NOTICE \[\w+\-\w+\] Ban <HOST>

    or even more simply expressed

    ^\.* Ban <HOST>$

Your Answer

