From 0b63fc312d27589edad94b9226d188bde8f6945f Mon Sep 17 00:00:00 2001 From: Vincent Laffargue Date: Sun, 10 Mar 2024 10:56:35 +0100 Subject: [PATCH] Change Regex Recidive and journalmatch For Systemd Match --- config/filter.d/recidive.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/filter.d/recidive.conf b/config/filter.d/recidive.conf index 63833cab..7dcecfe4 100644 --- a/config/filter.d/recidive.conf +++ b/config/filter.d/recidive.conf @@ -27,12 +27,12 @@ _daemon = (?:fail2ban(?:-server|\.actions)\s*) # this filter 'recidive', or supply another name with `filter = recidive[_jailname="jail"]` _jailname = recidive -failregex = ^%(__prefix_line)s(?:\s*fail2ban\.actions\s*%(__pid_re)s?:\s+)?NOTICE\s+\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ +failregex = ^%(__prefix_line)s(?:\s*fail2ban(?:\.actions)?\s*%(__pid_re)s?:\s+)?(?:NOTICE\s+)?\[(?!%(_jailname)s\])(?:.*)\]\s+Ban\s+\s*$ datepattern = ^{DATE} ignoreregex = -journalmatch = _SYSTEMD_UNIT=fail2ban.service PRIORITY=5 +journalmatch = _SYSTEMD_UNIT=fail2ban.service # Author: Tom Hendrikx, modifications by Amir Caspi