^<HOST> \- \- .*(\\x.*){10,} 400 166 \"\-\" \"\-\"$ would work to pick
up on the leading ' - - ', at least 10 "\x" and trailing ' 400 166 "-"
"-"'. I am not particularly happy with it. I'm sure you can do better
with the date and and the sequence of "\x"'s
Have you seen how to test a regex with fail2ban-regex?
Nick
On 08/07/2016 15:14, Mitchell Krog wrote:
> 169.229.3.91 - - [06/Jul/2016:10:26:00 +0200]
> "\xF1)1\xB0\x0E\xD6\xCEOSb`\xE3E\x90\xE1A\xB3\x7F\x8C\x0B\x02\xBF\x05RN\xD0\x87\x8F%=\x83(\x16\x9A\xDF5\x1D\xC8\x81<\x80l\xC6\xD8\xCD9\xA0\xE9\xDF~\xCEC\xFB\xF0\xCB\xB5\xD2\x85I\xAAVT\x98F"
>
> 400 166 "-" "-"
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
