0
votes

I've tried a few version of fail2ban in case of some bug.

Regexp in apache-noscript dont match below apache error log (Server version: Apache/2.4.38 (Debian):

[Wed Jul 24 14:24:12.697295 2019] [core:info] [pid 33220] [client 55.555.123.123:0] AH00128: File does not exist: /var/www/domain.name.com/test.asp

I've tried a lot of regexp from internet but non of them is working. fail2ban-regex shows 0 match for failregex (date template match fine)

I also used https://regex101.com/ site to match log line (1 by 1) but in jail it does not work :/

Regexp for date is fine Regexp for: [core:info] [pid 33220] [client 55.555.123.123:0] is fine matched by:

[(:?error|\S+:\S+)]( [pid \d+(:\S+ \d+)?])? [client (:\d{1,5})?]

Currently im using latest version fail2ban (here is link for conf file): https://github.com/fail2ban/fail2ban/blob/0.11/config/filter.d/apache-noscript.conf

I'm really don't know where is problem. What regexp should i use to match above apache log?

1

1 Answers

0
votes

OK. Problem solved.

Fail2ban is working on custom logs from rsyslog. Problem exist because of leading space at the begining of logs...

https://runnable.com/blog/the-mysterious-case-of-the-leading-space