0

Normally running the command would go like this:

$ fail2ban-regex /var/log/ningx/access.log \
    /etc/fail2ban/filter.d/nginx-noscript.conf -v

However, I have multiple files that I'd like to parse with the regex test. They have names like access.log, access.log.1, access.log.10.gz, access.log.111.gz and so on.

So I tried to use zcat and pipe it like this:

$ fail2ban-regex | zcat /var/log/ningx/access.log* \
   /etc/fail2ban/filter.d/nginx-noscript.conf -v`

but it's not working. How can I pipe it the right way?

Improve this question

1 Answer 1

Reset to default
2

You are piping from fail2ban into the zcat.

Pipes run from left to right. You need to pipe the output of zcat to the input of fail2ban

zcat ... | fail2ban-regex ...
Improve this answer
2
  • From the man page, I'm not sure if fail2ban-regex knows how to read from stdin by default (it expects a log entry as a string, or a log file path), so it may be necessary to use zcat access.log*.gz | fail2ban-regex /dev/stdin /etc/fail2ban/filter.d/nginx-noscript.conf
    – ilkkachu
    Commented Jul 8, 2018 at 9:03
  • 1
    It didn't work unfortunately.
    – answerSeeker
    Commented Jul 8, 2018 at 17:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .