Glpi fail2ban regex

Question

I'm using glpi and i want to monitoring the failed login attemtps with fail2ban. The log file is the following:

I need a regex rule for this log file, if the login attempts are failed and i want to ban the IP's with the fail2ban.

Can somebody help me?

Thanks!

Answer 1

use this: failed login for \w+ from IP (.*)

now your match group 1 holds the failed IP address. demo