Differences

This shows you the differences between two versions of the page.

--- linux:apps:fail2ban [2023/09/08 08:30] – [MAIL] oscar
+++ linux:apps:fail2ban [2024/12/28 08:18] (current) – [/etc/fail2ban/filter.d/nginx-x00.conf] oscar
@@ Line 505: / Line 505: @@
 [Definition]
-failregex = ^{"log":"<HOST> .* .*\\x.*$
+# Blocking repeated 404|444|403|400
+# This will also match requests that are entirely empty
+failregex = ^<HOST>.*"(GET|POST|HEAD).*" (404|444|403|400) .*$
-ignoreregex =
+datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
+              ^[^\[]*\[({DATE})
+              {^LN-BEG}
+journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
 </code>