Le 2015-06-04 16:00, Kamaldeep Singh a écrit : > Hi > On Thursday 04 June 2015 07:15 PM, Yves wrote: >> Hi, >> >> Le 2015-06-04 13:27, Kamaldeep Singh a écrit : >>> failregex = ^ sogod \[\d+\]: SOGoRootPage Login from '<HOST>' for >>> user '.*' might not have worked( - password policy: \d* grace: -?\d* >>> expire: -?\d* bound: -?\d*)?\s*$ >> I don't think that there should be a space between "sogod" and "\[". >> Also, I don't remember the syntax of SOGo's log files, but I doubt >> that your lines start with the string " sogod"; in doubt, I would >> replace this initial space with ".*"… > I am getting following line when i tried to put wrong password. > > Jun 04 13:40:41 sogod [19353]: SOGoRootPage Login from 'myip' for user > '[email protected]' might not have worked - password policy: > 65535 grace: -1 expire: -1 bound: 0 > > Therefore I guess the space between "sogod" and "\[\d+]:" is correct. Yes indeed.
> >> Just to be sure: >> — either your lines end with "…might not have worked" (with some >> spaces possible at the end), >> — or they end with "…have worked( - password …)" (with some spaces >> possible at the end). >> Strange that there are two different formats… > Sorry I didn't get you on this. The "?" near the end of your RE seems to indicate that the whole contents of the parenthesis is optional. I wrote too fast and wrongly included actual parenthesis in my examples above, but the meaning remains: I'm not sure the end of the line really is optional. Were I you, I'd try this: ^.* sogod \[\d+\]: SOGoRootPage Login from '<HOST>' for user '[^']*' might not have worked.*$ I realize that "^.*" at the start, and ".*$" at the end, are a bit silly regarding pattern-matching, but some tools do need to perform full-string matching, and I don't know where fail2ban stands in this regard. Yves. > > Thanks, > Kamaldeep Singh ------------------------------------------------------------------------------ _______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
