[fail2ban/nginxplus] Change format of fail2ban match

Previously, we were trying to match CLF formatted logs in access.log. But our access log is in a JSON format, so we needed to adjust the fail2ban failregex accordingl[fail2ban/nginxplus] Change format of fail2ban match Previously, we were trying to match CLF formatted logs in access.log. But our access log is in a JSON format, so we needed to adjust the fail2ban failregex accordingly Co-authored-by: Alicia Cozine <[email protected]> Co-authored-by: Christina Chortaria <[email protected]> Co-authored-by: Francis Kayiwa <[email protected]> Co-authored-by: James R. Griffin III <[email protected]> Co-authored-by: Kevin Reiss <[email protected]>
pulibrary · Dec 23, 2024 · 4382fd1 · 4382fd1
1 parent 0aeb5d3
commit 4382fd1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/roles/nginxplus/files/fail2ban/nginx-badbots-filter.conf b/roles/nginxplus/files/fail2ban/nginx-badbots-filter.conf
@@ -2,6 +2,6 @@
 
 badbots = 360Spider|claudebot|OAI-SearchBot|GPTBot
 
-failregex = (?i)<HOST> -.*"(GET|POST|HEAD).*HTTP.*(?:%(badbots)s).*"$
+failregex = (?i)\{\"remote_ip\"\: \"<HOST>\".*?\"user_agent\"\:.*?(?:%(badbots)s).*$
 
 ignoreregex =