github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Added the detailed explaination of `prefregex`

master
Egbert 2020-09-30 16:25:32 -04:00
parent 60f8dd3978
commit 150e8794da
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
Developing-Regex-in-Fail2ban.md

@ -57,6 +57,22 @@ PRE-FILTER MATCHED
==================
If you have a single-line pattern, skip this section and leave `prefregex` empty or undefined.
`prefregex` is a pattern of the entire log file that is inherently all the same within the same log file. Such common pattern found in line-by-line log file are:
* date (pretty much always)
* daemon name (optional)
* subroutine name and/or line number (optional)
* process ID (optional)
* severity level (optional)
So, the `prefregex` is highly dependent on proper supporting of this combinatorial of the above list of patterns (some always there, and mostly optional) in order to make it work for everyone that uses the application which generates the logs.
Secondary benefit of `prefregex` is to ensure that `failregex` is left with the most dynamic part of the line. `prefregex` takes that most common part (see above list) of the line.
```console
<--- prefregex -->|<-- failregex ->
3-Jan-2020 myscript: Dynamic error message part
```
To Pre-Filter or Not To Pre-Filter
-----------------------------------
This section only applies if you have (or will have) multiple patterns within this same filter file that you are creating or modifying.