title: fail2ban pattern for non-digit character matches input with digit
body: <p>This is my input string:</p>
  <pre><code>myserver:/etc/fail2ban # cat one_line.txt
  12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;
  </code></pre>
  <p>I tried to evolve a regular expression beginning with <code>^&lt;HOST&gt;.*$</code> and ending with <code>^&lt;HOST&gt; - - \[2.*$</code>, but when it came to the end something strange had happened.</p>
  <p>The last pattern iteration didn't match anymore.
  I can force a match when I state it like this <code>^&lt;HOST&gt; - - \[\D.*$</code>.</p>
  <p>Häh?. That would mean that a non-digit char follows the opening square bracket!</p>
  <p>I print the steps I took in order to show you how it evolved.</p>
  <p>Hope someone can explain me this strange behaviour.</p>
  <p>Environment Info:</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex --version
  fail2ban-regex 0.9.4
  myserver:/etc/fail2ban # python --version
  Python 2.7.17
  </code></pre>
  <p>And now follows the iterative evolving of my filter expression:</p>
  <p>Iteration 1: Match - as expected</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex -l heavydebug one_line.txt '^&lt;HOST&gt;.*$'
  
  Running tests
  =============
  
  D: Setting usedns = warn for Filter(None)
  D: Created Filter(None)
  Use   failregex line : ^&lt;HOST&gt;.*$
  Use         log file : one_line.txt
  Use         encoding : UTF-8
  
  D: Working on line u'12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;'
  D: Matched time template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Got time 1500967600.000000 for &quot;u'25/Jul/2017:09:26:40 +0200'&quot; using template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Looking for failregex match of [(u'12.123.123.12 - - [', u'25/Jul/2017:09:26:40 +0200', u'] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;')]
  D: Matched FailRegex('^(?:::f{4,6}:)?(?P&lt;host&gt;[\\w\\-.^_]*\\w).*$')
  D: Sorting the template list
  D: Winning template: Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? with 1 hits
  
  Results
  =======
  
  Failregex: 1 total
  |-  #) [# of hits] regular expression
  |   1) [1] ^&lt;HOST&gt;.*$
  `-
  
  Ignoreregex: 0 total
  
  Date template hits:
  |- [# of hits] date format
  |  [1] Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  `-
  
  Lines: 1 lines, 0 ignored, 1 matched, 0 missed
  [processed in 0.00 sec]
  </code></pre>
  <p>Iteration 2: Match - as expected</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex -l heavydebug one_line.txt '^&lt;HOST&gt; - - .*$'
  
  Running tests
  =============
  
  D: Setting usedns = warn for Filter(None)
  D: Created Filter(None)
  Use   failregex line : ^&lt;HOST&gt; - - .*$
  Use         log file : one_line.txt
  Use         encoding : UTF-8
  
  D: Working on line u'12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;'
  D: Matched time template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Got time 1500967600.000000 for &quot;u'25/Jul/2017:09:26:40 +0200'&quot; using template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Looking for failregex match of [(u'12.123.123.12 - - [', u'25/Jul/2017:09:26:40 +0200', u'] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;')]
  D: Matched FailRegex('^(?:::f{4,6}:)?(?P&lt;host&gt;[\\w\\-.^_]*\\w) - - .*$')
  D: Sorting the template list
  D: Winning template: Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? with 1 hits
  
  Results
  =======
  
  Failregex: 1 total
  |-  #) [# of hits] regular expression
  |   1) [1] ^&lt;HOST&gt; - - .*$
  `-
  
  Ignoreregex: 0 total
  
  Date template hits:
  |- [# of hits] date format
  |  [1] Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  `-
  
  Lines: 1 lines, 0 ignored, 1 matched, 0 missed
  [processed in 0.00 sec]
  </code></pre>
  <p>Iteration 3: Match - as expected</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex -l heavydebug one_line.txt '^&lt;HOST&gt; - - \[.*$'
  
  Running tests
  =============
  
  D: Setting usedns = warn for Filter(None)
  D: Created Filter(None)
  Use   failregex line : ^&lt;HOST&gt; - - \[.*$
  Use         log file : one_line.txt
  Use         encoding : UTF-8
  
  D: Working on line u'12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;'
  D: Matched time template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Got time 1500967600.000000 for &quot;u'25/Jul/2017:09:26:40 +0200'&quot; using template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Looking for failregex match of [(u'12.123.123.12 - - [', u'25/Jul/2017:09:26:40 +0200', u'] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;')]
  D: Matched FailRegex('^(?:::f{4,6}:)?(?P&lt;host&gt;[\\w\\-.^_]*\\w) - - \\[.*$')
  D: Sorting the template list
  D: Winning template: Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? with 1 hits
  
  Results
  =======
  
  Failregex: 1 total
  |-  #) [# of hits] regular expression
  |   1) [1] ^&lt;HOST&gt; - - \[.*$
  `-
  
  Ignoreregex: 0 total
  
  Date template hits:
  |- [# of hits] date format
  |  [1] Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  `-
  
  Lines: 1 lines, 0 ignored, 1 matched, 0 missed
  [processed in 0.00 sec]
  </code></pre>
  <p>Itertaion 4.1: Fail - Why ???</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex -l heavydebug one_line.txt '^&lt;HOST&gt; - - \[2.*$'
  
  Running tests
  =============
  
  D: Setting usedns = warn for Filter(None)
  D: Created Filter(None)
  Use   failregex line : ^&lt;HOST&gt; - - \[2.*$
  Use         log file : one_line.txt
  Use         encoding : UTF-8
  
  D: Working on line u'12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;'
  D: Matched time template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Got time 1500967600.000000 for &quot;u'25/Jul/2017:09:26:40 +0200'&quot; using template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Looking for failregex match of [(u'12.123.123.12 - - [', u'25/Jul/2017:09:26:40 +0200', u'] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;')]
  D: Sorting the template list
  D: Winning template: Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? with 1 hits
  
  Results
  =======
  
  Failregex: 0 total
  
  Ignoreregex: 0 total
  
  Date template hits:
  |- [# of hits] date format
  |  [1] Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  `-
  
  Lines: 1 lines, 0 ignored, 0 matched, 1 missed
  [processed in 0.00 sec]
  
  |- Missed line(s):
  |  12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;
  `-
  </code></pre>
  <p>Itertaion 4.2: Fail - Why ???</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex -l heavydebug one_line.txt '^&lt;HOST&gt; - - \[\d.*$'
  
  Running tests
  =============
  
  D: Setting usedns = warn for Filter(None)
  D: Created Filter(None)
  Use   failregex line : ^&lt;HOST&gt; - - \[\d.*$
  Use         log file : one_line.txt
  Use         encoding : UTF-8
  
  D: Working on line u'12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;'
  D: Matched time template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Got time 1500967600.000000 for &quot;u'25/Jul/2017:09:26:40 +0200'&quot; using template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Looking for failregex match of [(u'12.123.123.12 - - [', u'25/Jul/2017:09:26:40 +0200', u'] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;')]
  D: Sorting the template list
  D: Winning template: Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? with 1 hits
  
  Results
  =======
  
  Failregex: 0 total
  
  Ignoreregex: 0 total
  
  Date template hits:
  |- [# of hits] date format
  |  [1] Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  `-
  
  Lines: 1 lines, 0 ignored, 0 matched, 1 missed
  [processed in 0.00 sec]
  
  |- Missed line(s):
  |  12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;
  `-
  </code></pre>
  <p>Itertaion 4.3: Match - Why ???</p>
  <pre><code>myserver:/etc/fail2ban # fail2ban-regex -l heavydebug one_line.txt '^&lt;HOST&gt; - - \[\D.*$'
  
  Running tests
  =============
  
  D: Setting usedns = warn for Filter(None)
  D: Created Filter(None)
  Use   failregex line : ^&lt;HOST&gt; - - \[\D.*$
  Use         log file : one_line.txt
  Use         encoding : UTF-8
  
  D: Working on line u'12.123.123.12 - - [25/Jul/2017:09:26:40 +0200] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;'
  D: Matched time template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Got time 1500967600.000000 for &quot;u'25/Jul/2017:09:26:40 +0200'&quot; using template Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  D: Looking for failregex match of [(u'12.123.123.12 - - [', u'25/Jul/2017:09:26:40 +0200', u'] &quot;GET /a/path/file.html HTTP/1.1&quot; 200 1450 &quot;http://example.com/a/path/file.html&quot; &quot;Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36&quot;')]
  D: Matched FailRegex('^(?:::f{4,6}:)?(?P&lt;host&gt;[\\w\\-.^_]*\\w) - - \\[\\D.*$')
  D: Sorting the template list
  D: Winning template: Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)? with 1 hits
  
  Results
  =======
  
  Failregex: 1 total
  |-  #) [# of hits] regular expression
  |   1) [1] ^&lt;HOST&gt; - - \[\D.*$
  `-
  
  Ignoreregex: 0 total
  
  Date template hits:
  |- [# of hits] date format
  |  [1] Day(?P&lt;_sep&gt;[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
  `-
  
  Lines: 1 lines, 0 ignored, 1 matched, 0 missed
  [processed in 0.00 sec]
  </code></pre>
  <p>Thx in advance.</p>