fail2ban regex tester

fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

How to use the regex tester#

When it works here, confirm on the server with fail2ban-regex — the command at the bottom of the tool is ready to copy.

How accurate is it?#

The tester is a JavaScript port of the code fail2ban uses to decide whether a line is a failure: date detection with fail2ban's own date templates, prefregex and <F-CONTENT>, tag substitution for <HOST>, <ADDR>, <IP4>, <IP6>, <DNS>, <SUBNET>, <F-ID> and custom <F-…> groups, ignoreregex, and multi-line failure IDs (<F-MLFID>, <F-NOFAIL>). Built-in filters are translated from the regexes fail2ban itself compiles, including Python-only features such as conditional groups.

We check it against fail2ban's own results on every sample log line shipped in the fail2ban test suite: it agrees on 99.7% of 1,028 lines (the few differences are rare multi-line SSH session cases). Two things still differ from a real server:

• Python vs JavaScript regex. Custom regexes are converted from Python syntax ((?P<name>…), (?P=name)); conditional groups (?(name)…) only work in the built-in filters. Character classes like \w match only ASCII letters in the browser.
• Time windows. The tester counts every matched line, as if all of them fell inside findtime. fail2ban also ignores lines older than findtime and lines without a recognisable timestamp.

failregex cheat sheet#

A few rules that save hours:

• Anchor with ^. fail2ban removes the timestamp first, so ^ means "right after the date" for most logs. %(__prefix_line)s in built-in filters also skips the syslog hostname and daemon[pid]: prefix.
• Avoid greedy .* before <HOST>. An attacker can put an IP into a user name field; .* lets the regex grab the wrong address. Match the fixed text right before the address instead.
• One regex per line. Multiple failregex lines are tried in order; the first one that matches wins.

More detail in how to write a custom filter, or let the filter generator write a first version from one log line.

FAQ#

Is there an online fail2ban regex tester?#

Yes — this page. It runs fail2ban's matching rules in your browser: choose a built-in filter or type a failregex with <HOST>, paste log lines, and it shows which lines match, the extracted IP and the timestamp fail2ban would use. Your logs never leave your computer.

Why does my failregex not match?#

The usual causes: the regex expects the timestamp (fail2ban strips it first), it lacks a <HOST> or <F-ID> group, it uses greedy .* that skips past the address, or the log line has a prefix such as hostname sshd[123]: the regex doesn't account for. Paste the line here and compare against the built-in filter for the same service.

Can I test multiline regex here?#

Yes. Built-in filters that use maxlines (and <F-MLFID> correlation such as sshd) are processed line by line with a buffer, as fail2ban does. For custom multi-line patterns, use <SKIPLINES> and test the final version with fail2ban-regex.