El sáb., 2 nov. 2019 a las 0:13, Maykel Franco (<maykeldebian@xxxxxxxxx>) escribió: > > El vie., 1 nov. 2019 a las 19:20, Ralph Corderoy > (<ralph@xxxxxxxxxxxxxxx>) escribió: > > > > Hi Maykel, > > > > I don't use fail2ban, but I've just skimmed > > https://fail2ban.readthedocs.io/en/latest/filters.html#developing-filter-regular-expressions > > You may find the ‘debuggex’ reference useful. > > > > > failregex = Unknown User .* \(<HOST>:.*\) > > ... > > > [12:48:35.315] Server1: Unknown User 'test' (109.103.148.2) > > ... > > > Date template hits: > > > |- [# of hits] date format > > > | [6] {^LN-BEG}24hour:Minute:Second > > > > I take that to mean it was happy with the timestamp. > > > > > failregex = Unknown User .* \(<HOST>:.*\) > > > > How about > > > > failregex = ^\S+: Unknown User .* \(<HOST>\)$ > > > > -- > > Cheers, Ralph. > > Thanks for your help but not working... > > https://imgur.com/a/w0F2JSC It works with only: failregex = Unknown User .* \(<HOST>\)
