Resolved How to recognize fail2ban filter

[Zoo3]

Server operating system version

CentOS 7.9

Plesk version and microupdate number

18.0.48

I want to specify the following filter in Plesk fail2ban. Even though I create it in filter management, when I create a new jail it does not appear in the menu as an option in the list of filters. I'm able to create the filter itself, but cannot specify it in new jail.

How can I specify the filter if I process it in any way?

[Definition]
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)
failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"

 

[Peter Debik]

Have you added a section to the jail.local file for it? If so, have you reloaded fail2ban afterwards?

 

[Zoo3]

Have you added a section to the jail.local file for it? If so, have you reloaded fail2ban afterwards?

I don't use Plesk, just add it to jail.local on the command line and filter is specified.
Does that mean I can't specify the filter in the Plesk UI?

When I do the add to jail.local in Plesk, it is "Tool>fail2ban>jail tab>Add jail" right?
I manually create a jail in jail.local on the command line and then open the jail in Plesk and it is configured as it should be. But I can't choose a filter from the list.

 

[Peter Debik]

Could you please explain what you mean to "choose a filter from the list"? From which list and which filter?

 

[Zoo3]

Could you please explain what you mean to "choose a filter from the list"? From which list and which filter?

I click the "add jail" button. The progress will then go to the configuration page. On the top row there is a "name" field and the "Filter" I am describing is on the second row. This filter list includes "apache-auth -Apache authentication failure" and so on.
There the filters I have added within the filter management do not appear.

 

[Peter Debik]

The reason for the behavior is that the filter rule is missing this line:

ignoreregex =

Simply add it to the end of your rule. Afterwards the filter will become available in the filters list in Plesk GUI.

 

[Zoo3]

The reason for the behavior is that the filter rule is missing this line:

ignoreregex =

Simply add it to the end of your rule. Afterwards the filter will become available in the filters list in Plesk GUI.

Thank you !!
I was able to set it up with Plesk.