fail2ban-regex not filtering, banning IP addresses

dthims · 02-13-2016, 01:38 PM

getting a lot of these in my logs but fail2ban is not banning them. ip's are random
connect from unknown[1XX.22X.1XX.2XX]
disconnect from unknown[1XX.22X.1XX.2XX]

this is the filter i'm running it against but its not working. got the idea from this link - http://www.iredmail.org/forum/topic8...s-attacks.html

failregex = disconnect from unknown (.*)\[<HOST>\]
failregex = connect from unknown (.*)\[<HOST>\]

tia

Habitual · 02-13-2016, 02:53 PM

Show me the exact command please, including log and the filter used in it.

dthims · 02-13-2016, 04:49 PM

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/unknown.conf

Running tests
=============

Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [3495] MONTH Day Hour:Minute:Second
`-

Lines: 3495 lines, 0 ignored, 0 matched, 3495 missed
Missed line(s): too many to print. Use --print-all-missed to print all 3495 lines