El vie., 1 nov. 2019 a las 19:20, Ralph Corderoy (<ralph@xxxxxxxxxxxxxxx>) escribió: > > Hi Maykel, > > I don't use fail2ban, but I've just skimmed > https://fail2ban.readthedocs.io/en/latest/filters.html#developing-filter-regular-expressions > You may find the ‘debuggex’ reference useful. > > > failregex = Unknown User .* \(<HOST>:.*\) > ... > > [12:48:35.315] Server1: Unknown User 'test' (109.103.148.2) > ... > > Date template hits: > > |- [# of hits] date format > > | [6] {^LN-BEG}24hour:Minute:Second > > I take that to mean it was happy with the timestamp. > > > failregex = Unknown User .* \(<HOST>:.*\) > > How about > > failregex = ^\S+: Unknown User .* \(<HOST>\)$ > > -- > Cheers, Ralph. Thanks for your help but not working... https://imgur.com/a/w0F2JSC
