diff --git a/config/filter.d/zoneminder.conf b/config/filter.d/zoneminder.conf
new file mode 100644
index 00000000..cc82755a
--- /dev/null
+++ b/config/filter.d/zoneminder.conf
@@ -0,0 +1,21 @@
+# Fail2Ban filter for Zoneminder login failures
+
+[INCLUDES]
+before = apache-common.conf
+
+[Definition]
+
+# pattern: [Wed Apr 27 23:12:07.736196 2016] [:error] [pid 2460] [client 10.1.1.1:47296] WAR [Login denied for user "test"], referer: https://zoneminderurl/index.php
+#
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile.
+
+failregex = ^%(_apache_error_client)s WAR \[Login denied for user "[^"]*"\]
+
+ignoreregex =
+
+# Notes:
+#	Tested on Zoneminder 1.29.0
+#
+# Author: John Marzella
diff --git a/config/jail.conf b/config/jail.conf
index cf652fe2..29ad4c96 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -866,3 +866,11 @@ port    = http,https
 filter  = phpmyadmin-syslog
 logpath = %(syslog_authpriv)s
 backend = %(syslog_backend)s
+
+
+[zoneminder]
+# Zoneminder HTTP/HTTPS web interface auth
+# Logs auth failures to apache2 error log
+port    = http,https
+logpath = %(apache_error_log)s
+
diff --git a/fail2ban/tests/files/logs/zoneminder b/fail2ban/tests/files/logs/zoneminder
new file mode 100644
index 00000000..abd49869
--- /dev/null
+++ b/fail2ban/tests/files/logs/zoneminder
@@ -0,0 +1,2 @@
+# failJSON: { "time": "2016-03-28T16:50:49", "match": true , "host": "10.1.1.1" }
+[Mon Mar 28 16:50:49.522240 2016] [:error] [pid 1795] [client 10.1.1.1:50700] WAR [Login denied for user "username1"], referer: https://zoneminder/