无法让 fail2ban failregex 匹配日志

无法让 fail2ban failregex 匹配日志

这是失败的正则表达式

^(%(__prefix_line)s|\[\]\s*)%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"


log_prefix= (?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[C-[\da-f]*\])? \S+:\d*( in \w+:)?

这是我的日志文件中的行,上面的 failregex 应该匹配,但是当我通过 fail2ban-regex 运行它时却不匹配。

[2015-12-07 06:20:35] SECURITY[1231] res_security_log.c: SecurityEvent="FailedACL",EventTV="1449498035-843882",Severity="Error",Service="AMI",EventVersion="1",AccountID="admin",SessionID="0x9f93d24",LocalAddress="IPV4/TCP/0.0.0.0/5038",RemoteAddress="IPV4/TCP/217.23.7.173/37756",SessionTV="0-0"

相关内容