Skip to content

Commit 98b7992

Browse files
authored
Update index.md (#7211)
updated the command to not include backreference: Because: The pattern is trying to match a log line where the hour, minute, and second are equal to the day of the month (e.g., [10/Mar/2025:10:10:10). This is very unusual and restrictive for Fail2ban and might only match some synthetic or test logs, not real-world ones.
1 parent 56ce7d9 commit 98b7992

File tree

1 file changed

+2
-8
lines changed
  • docs/guides/security/basics/using-fail2ban-to-secure-your-server-a-tutorial

1 file changed

+2
-8
lines changed

docs/guides/security/basics/using-fail2ban-to-secure-your-server-a-tutorial/index.md

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -483,13 +483,7 @@ The best way to understand how failregex works is to write one. Although we do n
483483
<HOST> - - \[(\d{2})/\w{3}/\d{4}:
484484
```
485485
486-
1. The next sequence is a series of two-digit numbers that make up the time. Because we defined the day of the month as a two-digit number in a capture group (the parentheses), we can backreference it using `\1` (since it is the *first* capture group). Again, the colons are literals:
487-
488-
```command
489-
<HOST> - - \[(\d{2})/\w{3}/\d{4}:\1:\1:\1
490-
```
491-
492-
If you do not want to use backreferences this can also be written as:
486+
1. The next sequence is a series of two-digit numbers that make up the time. Again, the colons are literals:
493487
494488
```command
495489
<HOST> - - \[\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2}
@@ -617,4 +611,4 @@ CentOS 7 and Fedora additionally require two extra commands to be fully stopped
617611
618612
```command
619613
systemctl disable --now fail2ban
620-
```
614+
```

0 commit comments

Comments
 (0)