Fail2ban: ignoreregex not working

be descriptive: have you specified ignoreregex at all?

$> /usr/bin/fail2ban-regex | head
Usage: /usr/bin/fail2ban-regex [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]

so if I do add ignoregex to e.g. sshd.conf (although need to avoid
anchoring on the front since matching for ignoreregex is applied to full
line, without stripping time/date) -- it is all good

$> ./fail2ban-regex testcases/files/logs/sshd config/filter.d/sshd.conf config/filter.d/sshd.conf  2>/dev/null | grep -A2 Ignoreregex 
Ignoreregex: 2 total
|- #) [# of hits] regular expression
|  1) [2] \s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?|[\[\(]?sshd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:)?\s*(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$

$> grep ignoreregex config/filter.d/sshd.conf
# Option:  ignoreregex
ignoreregex = %(__prefix_line)s(?:error: PAM: )?Authentication failure for .* from <HOST>\s*$

On Fri, 21 Dec 2012, Jens-André Koch wrote:

The ignoreregex option in config files do not work (v0.8.4).
When testing with fail2ban-regex not even an "Unable to compile regular
expression" error is thrown.
No matches at all:

Ignoreregex
|- Regular expressions:

`- Number of matches:

I'm i missing a general configuration option or is this an bug?

Yaroslav O. Halchenko
Postdoctoral Fellow, Department of Psychological and Brain Sciences
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419
WWW: http://www.linkedin.com/in/yarik

:+1:
Ah, you are right. Thanks for pointing me to the correct third parameter.
I should have read the man pages before posting this.
Anyway this works:

fail2ban-regex error.log /etc/fail2ban/filter.d/suhosin.conf /etc/fail2ban/filter.d/suhosin.conf

I'm closing the issue. Merry Christmas. Bye.

Merry Christmas! ;)

On Fri, 21 Dec 2012, Jens-André Koch wrote:

[1]:+1:
Ah, you are right. Thanks for pointing me to the correct third parameter.
I should have read the man pages before posting this.
Anyway this works:
fail2ban-regex error.log /etc/fail2ban/filter.d/suhosin.conf
/etc/fail2ban/filter.d/suhosin.conf

I'm closing the issue. Merry Christmas. Bye.

—
Reply to this email directly or [2]view it on GitHub.

References

Visible links

1. https://github.com/fail2ban/fail2ban/issues/100#issuecomment-11623202

Yaroslav O. Halchenko
Postdoctoral Fellow, Department of Psychological and Brain Sciences
Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755
Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419
WWW: http://www.linkedin.com/in/yarik