fail2ban filter generator

How the generator builds the regex#

1. The timestamp is removed using fail2ban's own date templates — fail2ban strips the date before it applies failregex, so a good regex never mentions it.
2. The syslog prefix (hostname daemon[pid]:) is replaced with %(__prefix_line)s, the helper every built-in filter uses. It comes from common.conf, which the generated file includes.
3. The address becomes <HOST>. fail2ban expands it to a pattern that captures IPv4, IPv6 or a hostname. The user name, if you mark it, becomes <F-USER>…</F-USER> so it appears in ban notifications.
4. Everything else is escaped literally, with numbers (process IDs, ports, counters) turned into \d+ so the regex keeps working on the next line.

The result is a starting point. Always run it against the real log with fail2ban-regex — the command is generated for you — and check both the matched and the missed lines.

Make the filter robust#

• Feed it several lines. Paste a mix of failure lines and normal lines into "Test against more lines". The failure lines should match; successful logins and unrelated messages must not.
• Watch for user-controlled text. If an attacker can put an IP address into a field before the real address (a user name, a URL), make the text right before <HOST> as specific as possible, and avoid .* before it.
• One failregex per message. If the app logs failures in two different formats, add a second failregex line rather than one complicated pattern.
• Name things clearly. The filter name is the file name in /etc/fail2ban/filter.d/ and the default jail name.

The full syntax — prefregex, ignoreregex, datepattern, multi-line failures and all <F-…> tags — is explained in how to write a custom filter. Before writing one, check the filter library: fail2ban already ships filters for 96 services.

FAQ#

Is there a fail2ban regex generator?#

Yes — this page. Paste one log line, click the attacker's address, and it writes a failregex with <HOST>, a complete filter.d file, a jail and the fail2ban-regex command to test it. Everything runs in your browser.

The generated regex matches my sample but not other lines. Why?#

The generator turns the one line you pasted into a pattern, so other message formats from the same app need their own failregex line. Paste a few different failure lines into "Test against more lines", then add a second regex for the ones that miss.

Can I generate a filter for JSON logs?#

Yes: paste one JSON line and click the IP value; braces and quotes are escaped automatically. If the field order in your JSON logs varies, keep "Allow anything after the address" switched on and anchor the regex on the field name before the IP.

What should I do after generating the filter?#

Save it to /etc/fail2ban/filter.d/<name>.conf, run fail2ban-regex against the real log, check the missed lines, then add the jail and reload. The syntax behind it is explained in writing a custom filter.