On 2023-04-29 08:15, Jim Wright wrote: > [wright@localhost fail2ban] $ fail2ban-regex --print-all-matched > /var/log/dovecot.log /etc/fail2ban/filter.d/dovecot.conf > > Running tests > ============= <cut> > Results > ======= > > Prefregex: 45677 total > | ^(?:\[\])?\s*(?:<[^.]+\.[^.]+>\s+)?(?:\S+\s+)?(?:kernel:\s?\[ > *\d+\.\d+\]:?\s+)?(?:@vserver_\S+\s+)?(?:(?:(?:\[\d+\])?:\s+[\[\(]?(?:dovecot(?:-auth)?|auth)(?:\(\S+\))?[\]\)]?:?|[\[\(]?(?:dovecot(?:-auth)?|auth)(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)\s+)?(?:\[ID > > \d+ \S+\]\s+)?(?:(?:dovecot: )?auth(?:-worker)?(?:\([^\)]+\))?: > )?(?:pam_unix(?:\(dovecot:auth\))?: > |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?(?P<content>.+)$ > `- Would you show us "dovecot.conf"? I do not see where there is a regex for "unknown user."
-- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think. _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
