diff --git a/config/filter.d/apache-auth.conf b/config/filter.d/apache-auth.conf index 501e3d68..87d6edef 100644 --- a/config/filter.d/apache-auth.conf +++ b/config/filter.d/apache-auth.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failure messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = [[]client []] user .*(?:: authentication failure|not found) diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf index 45366867..280f72b9 100644 --- a/config/filter.d/apache-noscript.conf +++ b/config/filter.d/apache-noscript.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failure messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = [[]client []] File does not exist: .*(\.php|\.asp) diff --git a/config/filter.d/courierlogin.conf b/config/filter.d/courierlogin.conf index 0e6b7a11..90e55ce2 100644 --- a/config/filter.d/courierlogin.conf +++ b/config/filter.d/courierlogin.conf @@ -11,7 +11,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = LOGIN FAILED, ip=\[\]$ diff --git a/config/filter.d/couriersmtp.conf b/config/filter.d/couriersmtp.conf index d67a61ea..b695a707 100644 --- a/config/filter.d/couriersmtp.conf +++ b/config/filter.d/couriersmtp.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = error,relay=,.*550 User unknown diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index a0e0a974..90b19d55 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = reject: RCPT from (.*)\[\]: 554 diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf index 28921a01..65ff59b7 100644 --- a/config/filter.d/proftpd.conf +++ b/config/filter.d/proftpd.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = USER \S+: no such user found from \S* ?\[\] to \S+\s*$ diff --git a/config/filter.d/qmail.conf b/config/filter.d/qmail.conf index 3e4ae215..854d4ee2 100644 --- a/config/filter.d/qmail.conf +++ b/config/filter.d/qmail.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = (?:[\d,.]+[\d,.] rblsmtpd: |421 badiprbl: ip ) diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf index 3602b594..ad4fe463 100644 --- a/config/filter.d/sasl.conf +++ b/config/filter.d/sasl.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = : warning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$ diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf index 3c2c5db6..9659fa16 100644 --- a/config/filter.d/sshd.conf +++ b/config/filter.d/sshd.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) diff --git a/config/filter.d/vsftpd.conf b/config/filter.d/vsftpd.conf index 384fa36b..4955fcfc 100644 --- a/config/filter.d/vsftpd.conf +++ b/config/filter.d/vsftpd.conf @@ -10,7 +10,8 @@ # Option: failregex # Notes.: regex to match the password failures messages in the logfile. The # host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching. +# be used for standard IP/hostname matching and is only an alias for +# (?:::f{4,6}:)?(?P\S+) # Values: TEXT # failregex = vsftpd: \(pam_unix\) authentication failure; .* rhost=