fail2ban/config/filter.d/apache-common.conf

# Generic configuration items (to be used as interpolations) in other
# apache filters
#
# Author: Yaroslav Halchenko
#
#

[INCLUDES]

# Load customizations if any available
after = apache-common.local


[DEFAULT]

# Common prefix for [error] apache messages which also would include <HOST>
# Depending on the version it could be
# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]
# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]
# Reference: https://github.com/fail2ban/fail2ban/issues/268
_apache_error_client = \[[^]]*\] \[(error|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]( \S+:)?
BF: anchor apache- filters. Close #248 See https://vndh.net/note:fail2ban-089-denial-service for more information 12 years ago			`# Generic configuration items (to be used as interpolations) in other`
			`# apache filters`
			`#`
			`# Author: Yaroslav Halchenko`
			`#`
			`#`

			`[INCLUDES]`

			`# Load customizations if any available`
			`after = apache-common.local`


			`[DEFAULT]`

			`# Common prefix for [error] apache messages which also would include <HOST>`
BF: support apache 2.4 more detailed error log format. Close #268 12 years ago			`# Depending on the version it could be`
			`# 2.2: [Sat Jun 01 11:23:08 2013] [error] [client 1.2.3.4]`
			`# 2.4: [Thu Jun 27 11:55:44.569531 2013] [core:info] [pid 4101:tid 2992634688] [client 1.2.3.4:46652]`
			`# Reference: https://github.com/fail2ban/fail2ban/issues/268`
BF: apache-common regex - datetime could be entirely consumed 11 years ago			`_apache_error_client = \[[^]]*\] \[(error\|core:\S+)\]( \[pid \d+:\S+ \d+\])? \[client <HOST>(:\d{1,5})?\]( \S+:)?`