From 55fd21ec4bc8ee115c382b8a13fce673ecf1d0b3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Mon, 9 Feb 2009 20:27:35 +0000
Subject: [PATCH] - Made the named-refused regex a bit less restrictive in
 order to match logs with "view". Thanks to Stephen Gildea.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@730 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 ChangeLog                          | 2 ++
 config/filter.d/named-refused.conf | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 0d551c2d..8ecdf817 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -37,6 +37,8 @@ ver. 0.8.4 (2008/??/??) - stable
   #514163.
 - Use timetuple instead of utctimetuple for ISO 8601. Maybe
   not a 100% correct fix but seems to work. Tracker #2500276.
+- Made the named-refused regex a bit less restrictive in
+  order to match logs with "view". Thanks to Stephen Gildea. 
 
 ver. 0.8.3 (2008/07/17) - stable
 ----------
diff --git a/config/filter.d/named-refused.conf b/config/filter.d/named-refused.conf
index c2c06a8f..ebf7681a 100644
--- a/config/filter.d/named-refused.conf
+++ b/config/filter.d/named-refused.conf
@@ -26,7 +26,7 @@ __line_prefix=(?:\s\S+ %(__daemon_combs_re)s\s+)?
 # Notes.: regex to match the password failures messages in the logfile.
 # Values: TEXT
 #
-failregex = %(__line_prefix)sclient <HOST>#\S+: query(?: \(cache\))? '.*' denied\s*$
+failregex = %(__line_prefix)sclient <HOST>#.+: query(?: \(cache\))? '.*' denied\s*$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.