From 4e252be76f1e7a307fb626af9636e745f93547ec Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Tue, 25 Oct 2016 11:01:32 +0200 Subject: [PATCH] Update FILTERS closes #1591 --- FILTERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/FILTERS b/FILTERS index 10113dfc..e114973a 100644 --- a/FILTERS +++ b/FILTERS @@ -227,7 +227,7 @@ Regular expressions (failregex, ignoreregex) assume that the date/time has been removed from the log line (this is just how fail2ban works internally ATM). If the format is like ' error 1.2.3.4 is evil' then you need to match -the < at the start so regex should be similar to '^<> is evil$' using +the <> at the start so regex should be similar to '^<> error is evil$' using where the IP/domain name appears in the log line. The following general rules apply to regular expressions: