From 6a2d2aa97a4675980a475fbdf9024b4bddf06a7f Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <serg.brester@sebres.de>
Date: Fri, 8 Apr 2022 09:55:44 +0200
Subject: [PATCH] capture user, add datepattern (anchored exact main format and
 fail2ban defaults)

---
 config/filter.d/xrdp.conf | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/xrdp.conf b/config/filter.d/xrdp.conf
index c625b496..6937acb8 100644
--- a/config/filter.d/xrdp.conf
+++ b/config/filter.d/xrdp.conf
@@ -25,10 +25,11 @@ _daemon = xrdp-sesman
 
 [Definition]
 
-authfail_re = \[INFO \] AUTHFAIL: user=.+ ip=<HOST> time=\d+
+authfail_re = \[INFO \] AUTHFAIL: user=<F-USER>.+</F-USER> ip=<ADDR> time=\d+
 
 failregex = ^%(__prefix_line)s%(authfail_re)s$
 
 ignoreregex =
 
-
+datepattern = ^\[?%%ExY%%Exm%%Exd[-|T]%%ExH:?%%ExM:?%%ExS(?:[.,]%%f)?(?:\s*%%z)?\]?
+              ^{DATE}