Hi, I have both options covered in the working filter.
Regards, Dudi -----Original Message----- From: Nick Howitt via Fail2ban-users <[email protected]> Sent: Monday, 22 September, 2025 12:14 PM To: [email protected] Subject: Re: [Fail2ban-users] froxlor Or, perhaps simpler: WARNING: Unknown user tried to login.*"<HOST>" On 22/09/2025 09:22, Dudi Goldenberg wrote: > Thank you. > > I'll investigate. > > Regards, > Dudi > > -----Original Message----- > From: Tim Boneko via Fail2ban-users <[email protected]> > Sent: Monday, 22 September, 2025 11:18 AM > To: [email protected] > Subject: Re: [Fail2ban-users] froxlor > > That's one ugly regex which is too long for a single line like it should be: > > froxlor\.WARNING: Unknown user tried to login\. > {"source":"login","action":"50","user":"<HOST>"\} \[\] > > ...but it matches here. I only escaped special characters for Perl, i.e. > these ones: . ( ) [ ] { } by putting a \ directly before them. > Feel free to modify to your needs. > Cheers, > > tim > > > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > > > _______________________________________________ > Fail2ban-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/fail2ban-users _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
