FAIL2BAN-REGEX(1)

📦
version 1.1.1 · 4 versions
, in arch rolling, nixpkgs unstable

💅 fail2ban-regex — test Fail2ban "failregex" option

okay bestie, so you know how Fail2Ban reads log files full of password failure reports and then bans those sketchy IP addresses using firewall rules? yeah. this little icon is the tool that lets you test your regular expressions for "fail2ban" before you commit to them. it's giving "try before you buy" but for regex. no cap, it's a lifesaver. 🫶

✨ SYNOPSIS ✨

fail2ban-regex [OPTIONS] <LOG> <REGEX> [IGNOREREGEX]

🌸 DESCRIPTION 🌸

Fail2Ban reads log file that contains password failure report and bans the corresponding IP addresses using firewall rules.

This tools can test regular expressions for "fail2ban".

🦋 LOG:

  • string — a string representing a log line
  • filename — path to a log file (/var/log/auth.log)
  • systemd-journal — search systemd journal (systemd-python required), optionally with backend parameters, see man jail.conf for usage and examples (systemd-journal[journalflags=1]).

🎀 REGEX:

  • string — a string representing a 'failregex'
  • filter name of jail or filter, optionally with options — (sshd[mode=aggressive])
  • filename — path to a filter file (filter.d/sshd.conf)

🌈 IGNOREREGEX:

  • string — a string representing an 'ignoreregex'

💖 OPTIONS 💖

  • --version — show program's version number and exit
  • -h, --help — show this help message and exit
  • -c CONFIG, --config=CONFIG — set alternate config directory
  • -d DATEPATTERN, --datepattern=DATEPATTERN — set custom pattern used to match date/times
  • --timezone=TIMEZONE, --TZ=TIMEZONE — set time-zone used by convert time format
  • -e ENCODING, --encoding=ENCODING — File encoding. Default: system locale
  • -r, --raw — Raw hosts, don't resolve dns
  • --usedns=USEDNS — DNS specified replacement of tags <HOST> in regexp ('yes' - matches all form of hosts, 'no' - IP addresses only)
  • -L MAXLINES, --maxlines=MAXLINES — maxlines for multi-line regex.
  • -m JOURNALMATCH, --journalmatch=JOURNALMATCH — journalctl style matches overriding filter file. "systemd-journal" only
  • -l LOG_LEVEL, --log-level=LOG_LEVEL — Log level for the Fail2Ban logger to use
  • -V — get version in machine-readable short format
  • -v, --verbose — Increase verbosity
  • --verbosity=VERBOSE — Set numerical level of verbosity (0..4)
  • --verbose-date, --VD — Verbose date patterns/regex in output
  • -D, --debuggex — Produce debuggex.com urls for debugging there
  • --no-check-all — Disable check for all regex's
  • -o OUT, --out=OUT — Set token to print failure information only (row, id, ip, msg, host, ip4, ip6, dns, matches, ...)
  • -i, --invert — Invert the sense of matching, to output non-matching lines.
  • --print-no-missed — Do not print any missed lines
  • --print-no-ignored — Do not print any ignored lines
  • --print-all-matched — Print all matched lines
  • --print-all-missed — Print all missed lines, no matter how many
  • --print-all-ignored — Print all ignored lines, no matter how many
  • -t, --log-traceback — Enrich log-messages with compressed tracebacks
  • --full-traceback — Either to make the tracebacks full, not compressed (as by default)

👑 AUTHOR 👑

Written by Cyril Jaquier <cyril.jaquier@fail2ban.org>. Many contributions by Yaroslav O. Halchenko, Steven Hiscocks, Sergey G. Brester (sebres).

🚨 REPORTING BUGS 🚨

Report bugs to https://github.com/fail2ban/fail2ban/issues

Copyright © 2004-2008 Cyril Jaquier, 2008- Fail2Ban Contributors

Copyright of modifications held by their respective authors. Licensed under the GNU General Public License v2 (GPL).

🔥 SEE ALSO 🔥

fail2ban-client(1) fail2ban-server(1) jail.conf(5)

okay that's the whole vibe, bestie — go test those regexes and slay ✨

this has been fail2ban-regex 1.1.1, dated August 2026 — catch you in the logs 💜

📦 where this page comes from