0

sorry for my bad english, I'am not familiar with fail2ban , I need help in order to automaticly ban some ips who tries to connect on my server, I can't find the correct regex in order to let failban work correctly.

here is a part of my log

85.225.94.226 - - [03/Feb/2016:12:34:04 +0100] "GET /live/test/test/102.ts HTTP/1.1" 200 0 "-" "VLC/2.1.0 LibVLC/2.2.1"
85.225.94.226 - - [03/Feb/2016:12:34:05 +0100] "GET /live/test/test/102.ts HTTP/1.1" 200 0 "-" "VLC/2.1.0 LibVLC/2.2.1"

I want the correct failregex value in order to ban the ip 85.225.94.226 also iI want to inculde this part "/test/test/" in the failregex as well

I made it like this but it doesnt work

failregex = <HOST> - - [.*] "GET /live/test/test/.*
0

This should work:

^<HOST>.*] "GET */test/test/*

You can check if the regex is working by running the following command:

fail2ban-regex /var/log/yourlog.log /etc/fail2ban/filter.d/yourfilter.conf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.