I tried to create a custom jail rule in fail2ban, but it never gets applied.

I did not find such an official documentation, I might miss something.


failregex = .* from ip <HOST>


enabled  = true
filter   = expressjs
logpath  = /var/log/expressjs/slowin-killer.log
maxretry = 5
bantime  = 3600
findtime = 600


[20-5-2017 20:49:57] Failed to authentificate user "dinath.contact@gmail.comdddd" from ip
[20-5-2017 20:57:19] Failed to authentificate user "dinath.contact@gmail.comdddd" from ip
[20-5-2017 20:59:20] Failed to authentificate user "dinath.contact@gmail.comdddd" from ip
[20-5-2017 21:12:47] Failed to authentificate user "dinath.contact@gmail.comdddd" from ip
[20-5-2017 21:16:9] Failed to authentificate user "dinath.contact@gmail.comdddd" from ip

No error message, but the jail seems to be active...

$ fail2ban-client status expressjs
Status for the jail: expressjs
|- Filter
|  |- Currently failed: 0
|  |- Total failed: 0
|  `- File list:    /var/log/expressjs/slowin-killer.log
`- Actions
   |- Currently banned: 0
   |- Total banned: 0
   `- Banned IP list:   

And the weird thing, regex is ok...

fail2ban-regex /var/log/expressjs/slowin-killer.log /etc/fail2ban/filter.d/expressjs.conf

Running tests

Use   failregex filter file : expressjs, basedir: /etc/fail2ban
Use         log file : /var/log/expressjs/slowin-killer.log
Use         encoding : UTF-8


Failregex: 27 total
|-  #) [# of hits] regular expression
|   1) [27] .* from ip <HOST>

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [34] Day(?P<_sep>[-/])Month(?P=_sep)(?:Year|Year2) 24hour:Minute:Second
|  [1] (?:DAY )?MON Day Year 24hour:Minute:Second(?:\.Microseconds)?

Lines: 162 lines, 0 ignored, 27 matched, 135 missed
[processed in 0.01 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 135 lines
  • Maybe an action = setting problem. serverfault.com/questions/727807/…
    – VPfB
    May 30, 2017 at 11:22
  • Thank you, but I already tried it :/
    – Alexsoyes
    Jun 3, 2017 at 11:28
  • how is configured the IPTable part of your failtoban, looks like your rule is not applied
    – Kiwy
    Jun 5, 2018 at 14:39

1 Answer 1


There are some things that you are missing and need to fix to make the filter work:

  1. Inside your expressjs.conf you have set findtime = 600 and maxretry = 5 This means that in a space of 10 minutes(600s) you will need to have 5 failed tries(regex match) to generate the automatic block/reject iptables rule. jail.conf manpage:
          time interval (in seconds) before the current time where failures will count towards a ban.

          number of failures that have to occur in the last findtime seconds to ban then IP.

Taking a look at your logs, you have more than 10 minutes between 1st log entry and last log entry(5 tries) on the log you pasted here. First: 20:49, Last:21:16

  1. All your logs comes from If you look at your jail.conf inside the [DEFAULT] block you will find the ignoreip = default configuration. Unless you have changed that, it's pretty dangerous to block a localhost address since will break other softwares using this address for internal communication.

  2. You expressjs.conf does not have the datepattern = configuration set so, fail2ban cannot guess what part of the logfile is the date. Get some examples from /etc/fail2ban/filter.d files and you will find date regex like datepattern = ^L %%d/%%m/%%Y - %%H:%%M:%%S or datepattern = ^%%Y:%%m:%%d-%%H:%%M:%%S. Other issue here is that your "second" part of the log date does not have the trailing zero on sec < 10 (ex: 21:16:9 on your last log) and this needs to be fixed.

Take a look at the Fail2ban official wiki to get examples and make your filter better. You have a lot of things to fix.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.