I think if you put this it should work:
^waynesallee.com:80 <HOST>.*BanMePleass
If the literal text doesn't work, a quick and dirty thing to do is to use
.* (a dot and an asterisk), which means "any characters") - so,
^.*<HOST> etc
Tony
On Wed, 15 Aug 2018 at 20:29, Wayne Sallee <[email protected]> wrote:
> fail2ban is expecting the first entry to be the ip address of the bot, but
> the bot's ip address comes after the domain
> name visited.
>
> So what to I need to do to the filter to fix this?
>
> Wayne Sallee
> [email protected]
> http://www.WayneSallee.com
>
> On 08/15/2018 03:21 PM, Wayne Sallee wrote:
> > How should I change the following filter to fix this?
> > failregex = ^<HOST>.*BanMePlease
> >
> > My logfiles look like this:
> > waynesallee.com:80 11.111.11.111
> >
> > Wayne Sallee
> > [email protected]
> > http://www.WayneSallee.com
> >
> > On 08/15/2018 03:17 PM, Wayne Sallee wrote:
> >> fail2ban looks at website in the log and get's its ip address, instead
> of looking at the ip address in the log.
> >>
> >> Wayne Sallee
> >> [email protected]
> >> http://www.WayneSallee.com
> >>
> >>
> ------------------------------------------------------------------------------
> >> Check out the vibrant tech community on one of the world's most
> >> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> >> _______________________________________________
> >> Fail2ban-users mailing list
> >> [email protected]
> >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
> >>
> >
> >
> >
> ------------------------------------------------------------------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> > _______________________________________________
> > Fail2ban-users mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> Fail2ban-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>
--
-- Tony Collins
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
