Fail2ban filter apache-noscript does not match entries in apache log

Question

I'm using fail2ban 9.6.1 standard filters apache-common.conf and apache-noscript.conf. However the apache-noscript does not match such entries in apache error_log:

[Thu Nov 23 07:32:25 2017] [error] [client 999.999.999.999] File does not exist: /path/to/requested/file

The _apache_error_client is:

_apache_error_client = \[\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client <HOST>(:\d{1,5})?\]

The failregex in apache-noscript is:

failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
            ^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$

I guess I have either to modify the regex somehow or the log format of apache.
I tried removing the pid part from _apache_error_client but without success.

Any suggestions are welcome.

Thanks.

G.Grein G.Grein · Accepted Answer · 2017-11-24T09:23:21

I got an answer for this. Adding a ? to /\S*(php([45]|[.-]cgi)?|.asp|.exe|.pl) fixes the problem. So the working regex is

^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|.asp|.exe|.pl)?(, referer: \S+)?\s*$

This can be marked as fixed.

Thanks

Fail2ban filter apache-noscript does not match entries in apache log

1 Answers