这是一个创建于 2106 天前的主题，其中的信息可能已经有所发展或是发生改变。
求 V 友帮忙看看指点一下 谢谢!
目的是想用 fail2ban 屏蔽来探测的 ip
log 如下 :
Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error
正规表达式如下:
failregex = ^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$
我测试却没法匹配, 不知道问题出在哪?
fail2ban-regex '2019-03-21 02:50:41 ERROR: failed to handshake with 95.179.169.185: authentication error' '^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$'
Running tests
=============
Use failregex line : ^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s...
Use single line : 2019-03-21 02:50:41 ERROR: failed to handshake wit...
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [1] Year(?P<_sep>[-/.])Month(?P=_sep)Day 24hour:Minute:Second(?:,Microseconds)?
`-
Lines: 1 lines, 0 ignored, 0 matched, 1 missed
[processed in 0.00 sec]
|- Missed line(s):
| 2019-03-21 02:50:41 ERROR: failed to handshake with 95.179.169.185: authentication error
`-
目的是想用 fail2ban 屏蔽来探测的 ip
log 如下 :
Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error
正规表达式如下:
failregex = ^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$
我测试却没法匹配, 不知道问题出在哪?
fail2ban-regex '2019-03-21 02:50:41 ERROR: failed to handshake with 95.179.169.185: authentication error' '^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$'
Running tests
=============
Use failregex line : ^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s...
Use single line : 2019-03-21 02:50:41 ERROR: failed to handshake wit...
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [1] Year(?P<_sep>[-/.])Month(?P=_sep)Day 24hour:Minute:Second(?:,Microseconds)?
`-
Lines: 1 lines, 0 ignored, 0 matched, 1 missed
[processed in 0.00 sec]
|- Missed line(s):
| 2019-03-21 02:50:41 ERROR: failed to handshake with 95.179.169.185: authentication error
`-
第 1 条附言 · 2019-03-21 18:38:29 +08:00
测试了这个命令也不行
fail2ban-regex 'Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error' '^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$'
fail2ban-regex 'Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error' '^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$'
 |
1
jcsmallming 2019-03-22 10:01:35 +08:00
第二个语句把 '%(__prefix_line)s' 换成 '.*' 倒是能匹配，不太清楚你的 '%(__prefix_line)s' 会替换成什么内容。
第一个语句看起来应该就是不能匹配的，毕竟你用的是 '+' ，你用 '2019-03-21...' 去匹配，开头的 '^\w+' 要求的至少出现一个字符就已经不能满足了。 |
|
2
jcsmallming 2019-03-22 10:07:44 +08:00
@jcsmallming 啊，记错了，\w 也能匹配数字来着，第一个语句的问题应该是没有正确匹配到日期的 '-' 符号，不好意思
|
Select Language