postfix access_list is not getting "regexed"

[gerbert]

Hi! I have an issue with access list for postfix. The format is pretty straightforward as well as regex which for some reason doesn't work...
E.g., input file contains entries similar to the following:
192.168.1.1 REJECT 520 Rejected
192.168.1.2 REJECT 520 Rejected
...
192.168.1.10 OK
failregex = ^<HOST>\s+REJECT\s+\d{3}\s+Rejected$
Which doesn't work. Broke my brain with various combinations...
fail2ban version is 0.10.2-2.1 (from official Debian 10 repo). Any suggestions would very nice!

P.S. - regex101 gives correct output if <HOST> is expanded and complete regex looks like this:
^(?:(?:::f{4,6}:)?(?P<ip4>(?:\d{1,3}\.){3}\d{1,3})|\[?(?P<ip6>(?:[0-9a-fA-F]{1,4}::?|::){1,7}(?:[0-9a-fA-F]{1,4}|(?<=:):))\]?|(?P<dns>[\w\-.^_]*\w))\s+REJECT\s+\d{3}\s+Rejected$

[sebres]

Fail2ban up to 0.10.6 expects a datepattern to monitor log-files (not the journals), this was extended within #2814, so the datepattern can be set to {NONE} which would allow to find failures totally without date-time in log messages (filter uses now as timestamp).

[gerbert]

I understand. But in this specific case, I only have a multi-line file, which contains entries, similar to this one:
192.168.1.1 REJECT 520 Rejected
So there is no date. Basically only IP address which comes first, then the word, number and another word. But for some reason the regex I mentioned above doesn't work...

[sebres]

But for some reason the regex I mentioned above doesn't work...

And the reason is, as already said, your fail2ban version 0.10.2 is unable to find the timestamp in log (because doesn't work without datepattern). Either upgrade to 0.10.6, or use/write other log-format (or switch to systemd journal).

[gerbert]

I see. Either back ports will save the world, or using the source directly... Got it. Thanks a lot!