fail2ban-regex1
Test fail2ban "failregex" option
Usage
fail2ban-regex [OPTIONS]
<LOG>
<REGEX>
[IGNOREREGEX]
Overview
Fail2Ban reads log file that contains password failure report and bans the corresponding IP addresses using firewall rules.
This tools can test regular expressions for "fail2ban".
Log:
- string
-
a string representing a log line
- filename
-
path to a log file (/var/log/auth.log)
- systemd-journal
-
search systemd journal (systemd-python required), optionally with backend parameters, see `man jail.conf` for usage and examples (systemd-journal[journalflags=1]).
Regex:
string
|
a string representing a 'failregex' |
|---|---|
filter
|
name of jail or filter, optionally with options (sshd[mode=aggressive]) |
filename
|
path to a filter file (filter.d/sshd.conf) |
Ignoreregex:
- string
-
a string representing an 'ignoreregex'
Options
-
--version -
show program's version number and exit
-
-h, --help -
show this help message and exit
-
-c CONFIG, --config=CONFIG -
set alternate config directory
-
-d DATEPATTERN, --datepattern=DATEPATTERN -
set custom pattern used to match date/times
-
--timezone=TIMEZONE, --TZ=TIMEZONE -
set time-zone used by convert time format
-
-e ENCODING, --encoding=ENCODING -
File encoding. Default: system locale
-
-r, --raw -
Raw hosts, don't resolve dns
-
--usedns=USEDNS -
DNS specified replacement of tags <HOST> in regexp ('yes' - matches all form of hosts, 'no' - IP addresses only)
-
-L MAXLINES, --maxlines=MAXLINES -
maxlines for multi-line regex.
-
-m JOURNALMATCH, --journalmatch=JOURNALMATCH -
journalctl style matches overriding filter file. "systemd-journal" only
-
-l LOG_LEVEL, --log-level=LOG_LEVEL -
Log level for the Fail2Ban logger to use
-
-V -
get version in machine-readable short format
-
-v, --verbose -
Increase verbosity
-
--verbosity=VERBOSE -
Set numerical level of verbosity (0..4)
-
--verbose-date, --VD -
Verbose date patterns/regex in output
-
-D, --debuggex -
Produce debuggex.com urls for debugging there
-
--no-check-all -
Disable check for all regex's
-
-o OUT, --out=OUT -
Set token to print failure information only (row, id, ip, msg, host, ip4, ip6, dns, matches, ...)
-
-i, --invert -
Invert the sense of matching, to output non-matching lines.
-
--print-no-missed -
Do not print any missed lines
-
--print-no-ignored -
Do not print any ignored lines
-
--print-all-matched -
Print all matched lines
-
--print-all-missed -
Print all missed lines, no matter how many
-
--print-all-ignored -
Print all ignored lines, no matter how many
-
-t, --log-traceback -
Enrich log-messages with compressed tracebacks
-
--full-traceback -
Either to make the tracebacks full, not compressed (as by default)
Releases
11 releases since Debian 4.0 (Etch); the text changed 8 times.
--TZ since Debian 10 (Buster);
--VD since Debian 10 (Buster);
--config since Debian 10 (Buster);
--datepattern since Debian 9 (Stretch);
--debuggex since Debian 8 (Jessie);
--encoding since Debian 9 (Stretch);
--full-traceback since Debian 8 (Jessie);
--help since Debian 5.0 (Lenny);
--invert since Arch Linux 2026-11-01;
--journalmatch since Debian 9 (Stretch);
--log-level since Debian 8 (Jessie);
--log-traceback since Debian 8 (Jessie);
--maxlines since Debian 9 (Stretch);
--no-check-all since Debian 11 (Bullseye);
--out since Debian 11 (Bullseye);
--print-all-ignored since Debian 8 (Jessie);
--print-all-matched since Debian 9 (Stretch);
--print-all-missed since Debian 8 (Jessie);
--print-no-ignored since Debian 8 (Jessie);
--print-no-missed since Debian 8 (Jessie);
--raw since Debian 9 (Stretch);
--timezone since Debian 10 (Buster);
--usedns since Debian 10 (Buster);
--verbose since Debian 8 (Jessie);
--verbose-date since Debian 10 (Buster);
--verbosity since Debian 10 (Buster);
--version since Debian 5.0 (Lenny);
-D since Debian 8 (Jessie);
-L since Debian 9 (Stretch);
-V since Debian 11 (Bullseye);
-c since Debian 10 (Buster);
-d since Debian 9 (Stretch);
-e since Debian 9 (Stretch);
-h since Debian 5.0 (Lenny);
-i since Arch Linux 2026-11-01;
-l since Debian 8 (Jessie);
-m since Debian 9 (Stretch);
-o since Debian 11 (Bullseye);
-r since Debian 9 (Stretch);
-t since Debian 8 (Jessie);
-v since Debian 8 (Jessie).