github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

Restore a heading line. Replaced example.tld with actual top-level domain name `sl`

master
Egbert 2020-09-20 18:42:18 -04:00
parent 5ef321210a
commit 5a961b631f
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Developing-Regex-in-Fail2ban.md

@ -118,11 +118,14 @@ Now I am matching SOMETHING!
Notice the convoluted patterns after '`query.+?`' These long patterns represent '`<HOST>`' part. We can safely ignore that for now.
Most importantly, I am MATCHING something that starts with '`^query`'! Yippee!
GYRATING TOWARD FULL MATCH
==========================
With a working matching pattern (albeit a failed but overly-broad pattern), we can then work toward a full-blown but concise (yet flexible) pattern.
With a working matching pattern (albeit a failed but overly-broad pattern), we can then work toward a full-blown concise (yet flexible) pattern.
Let’s start by adding more static pattern.
Let’s start by adding more static pattern. I am pretty sure from my intensive examination of that line 5445 in Bind9 `query.c` source file that '`query-error: info:`' is something that will not change for my target condition. This log output may have other variance like '`query-error: warn`' or '`query-error: debug`' but I am ignoring those.
I am pretty sure from my intensive examination of that line 5445 in Bind9 `query.c` source file that '`query-error: info:`' is something that will not change for my target condition. This log output may have other variance like '`query-error: warn`' or '`query-error: debug`' but I am ignoring those.
First iteration of `failregex` expansion:
```ini
@ -218,7 +221,7 @@ FINAL STRETCH
=============
We have the remaining of log text left to go:
```console
query failed (REFUSED) for example.tld/IN/ANY at query.c:5445
query failed (REFUSED) for sl/IN/ANY at query.c:5445
```
We’re impatient lot, aren’t we? Rush it up with:
```ini