From 6b519d54dbae9cef64c0174b82df3ded8250f146 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Thu, 10 Oct 2013 07:13:37 +1100 Subject: [PATCH] ENH: filter.d/recidive - replace ignore regex with a negative lookahead assertion --- config/filter.d/recidive.conf | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf index 856f06a4..617e008a 100644 --- a/config/filter.d/recidive.conf +++ b/config/filter.d/recidive.conf @@ -31,18 +31,5 @@ _daemon = fail2ban\.actions # jail using this filter 'recidive', or change this line! _jailname = recidive -# Option: failregex -# Notes.: regex to match the password failures messages in the logfile. The -# host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching and is only an alias for -# (?:::f{4,6}:)?(?P\S+) -# Values: TEXT -# -failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?:.*)\]\s+Ban\s+\s*$ +failregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ -# Option: ignoreregex -# Notes.: regex to ignore. If this regex matches, the line is ignored. -# Values: TEXT -# -# Ignore our own bans, to keep our counts exact. -ignoreregex = ^(%(__prefix_line)s|,\d{3} fail2ban.actions:\s+)WARNING\s+\[%(_jailname)s\]\s+Ban\s+\s*$