From e8ffab28fb8c50c576f0422c726b0b1c04829397 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 13:18:55 +0100
Subject: [PATCH 1/4] filter.d/apache-noscript.conf: extended to match "Primary
 script unknown", got from php-fpm module.

---
 config/filter.d/apache-noscript.conf      | 9 +++++++--
 fail2ban/tests/files/logs/apache-noscript | 2 ++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index fbc1af64..abc083a6 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -17,8 +17,13 @@ before = apache-common.conf
 
 [Definition]
 
-failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
-            ^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
+script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
+
+prefregex = ^%(_apache_error_client)s <F-CONTENT>.+</F-CONTENT>$
+
+failregex = ^(?:(?:AH001(?:28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <script>\b
+            ^script '<script>\S*' not found or unable to stat
+            ^(?:AH01071: )?Got error 'Primary script unknown\\n'
 
 ignoreregex = 
 
diff --git a/fail2ban/tests/files/logs/apache-noscript b/fail2ban/tests/files/logs/apache-noscript
index 68fc7c0a..91c55571 100644
--- a/fail2ban/tests/files/logs/apache-noscript
+++ b/fail2ban/tests/files/logs/apache-noscript
@@ -16,3 +16,5 @@
 # apache 2.4
 # failJSON: { "time": "2013-12-23T07:49:01", "match": true , "host": "204.232.202.107" }
 [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to stat
+# failJSON: { "time": "2018-03-11T08:56:20", "match": true , "host": "192.0.2.106", "desc": "php-fpm error" }
+[Sun Mar 11 08:56:20.913548 2018] [proxy_fcgi:error] [pid 742:tid 140142593419008] [client 192.0.2.106:50900] AH01071: Got error 'Primary script unknown\n'
\ No newline at end of file

From 8763cf0a362e507dc664928b0e74306d5b9f4150 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 14:26:51 +0100
Subject: [PATCH 2/4] ChangeLog updated

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index ceb3c822..238bf56c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -48,6 +48,7 @@ ver. 0.10.3-dev-1 (20??/??/??) - development edition
 ### New Features
 
 ### Enhancements
+* `filter.d/apache-noscript.conf`: extend failregex to match "Primary script unknown", e. g. from php-fpm (gh-2073);
 * date-detector extended with long epoch (`LEPOCH`) to parse milliseconds/microseconds posix-dates (gh-2029);
 * possibility to specify own regex-pattern to match epoch date-time, e. g. `^\[{EPOCH}\]` or `^\[{LEPOCH}\]` (gh-2038);
   the epoch-pattern similar to `{DATE}` patterns does the capture and cuts out the match of whole pattern from the log-line,

From 185cb998e7c7f2509830bed4a9f2fe6179f77e7b Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 14:38:47 +0100
Subject: [PATCH 3/4] make `prefregex` more precise in order to avoid catch the
 content for non failure lines

---
 config/filter.d/apache-noscript.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index abc083a6..8858d635 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -19,11 +19,11 @@ before = apache-common.conf
 
 script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
 
-prefregex = ^%(_apache_error_client)s <F-CONTENT>.+</F-CONTENT>$
+prefregex = ^%(_apache_error_client)s <F-CONTENT>(?:(?:AH0(?:01(?:28|30)|1(?:264|071)): )|(?:(?:[Ff]ile|script|[Gg]ot) )).+</F-CONTENT>$
 
-failregex = ^(?:(?:AH001(?:28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <script>\b
+failregex = ^(?:(?:AH001(?:28|30): )?[Ff]ile does not exist|(AH01264: )?script not found or unable to stat): <script>\b
             ^script '<script>\S*' not found or unable to stat
-            ^(?:AH01071: )?Got error 'Primary script unknown\\n'
+            ^(?:AH01071: )?[Gg]ot error '[Pp]rimary script unknown\\n'
 
 ignoreregex = 
 

From 7b3442c4e205fe04edcfa610b037193a9ddbead3 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 14:53:56 +0100
Subject: [PATCH 4/4] amend to 185cb998e7c7f2509830bed4a9f2fe6179f77e7b:
 capture error prefix outside of the failure content;

---
 config/filter.d/apache-noscript.conf | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 8858d635..1963d1dd 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -19,11 +19,11 @@ before = apache-common.conf
 
 script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
 
-prefregex = ^%(_apache_error_client)s <F-CONTENT>(?:(?:AH0(?:01(?:28|30)|1(?:264|071)): )|(?:(?:[Ff]ile|script|[Gg]ot) )).+</F-CONTENT>$
+prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
 
-failregex = ^(?:(?:AH001(?:28|30): )?[Ff]ile does not exist|(AH01264: )?script not found or unable to stat): <script>\b
-            ^script '<script>\S*' not found or unable to stat
-            ^(?:AH01071: )?[Gg]ot error '[Pp]rimary script unknown\\n'
+failregex = ^(?:does not exist|not found or unable to stat): <script>\b
+            ^'<script>\S*' not found or unable to stat
+            ^error '[Pp]rimary script unknown\\n'
 
 ignoreregex =