fail2ban/config/filter.d/guacamole.conf

# Fail2Ban configuration file for guacamole
#
# Author: Steven Hiscocks
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT
#
failregex = ^.*\nWARNING: Authentication attempt from <HOST> for user "[^"]*" failed\.$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex = 

# "maxlines" is number of log lines to buffer for multi-line regex searches
maxlines = 2

datepattern = ^%%b %%d, %%ExY %%I:%%M:%%S %%p
              ^WARNING:()**
              {^LN-BEG}