Need help with failregex

[ghost]

Hello,

I try to setup Fail2ban with apache mod evasive

My issue is that failregex founded on a tutorial dont match whith my log format.

Exemple of log:

[Thu Feb 17 09:25:24.225629 2022] [evasive20:error] [pid 2245693:tid 140292849272576] [client 92.154.23.109:50015] client denied by server configuration: proxy:http://127.0.0.1:80/fr/customer/section/load/,>

I have to take fail2ban action for ip 92.154.23.109 matching with [evasive20:error] ... client denied by server configuration

Thank you in advance for help

[sebres]

[Definition]
failregex = ^\s*(?:\[\] )?\[evasive\d+:error\] \[[^\]]*\] \[client <ADDR>:\d+\] client denied by server configuration\b

(?:\[\] )? matches the remaining [] after fail2ban cuts out the timestamp matching default datepattern (optional if it'd change or if the backend switches to systemd journal).

[ghost]

Thank you a lot. I have to try it.