Normally running the command would go like this:

$ fail2ban-regex /var/log/ningx/access.log \
    /etc/fail2ban/filter.d/nginx-noscript.conf -v

However, I have multiple files that I'd like to parse with the regex test. They have names like access.log, access.log.1, access.log.10.gz, access.log.111.gz and so on.

So I tried to use zcat and pipe it like this:

$ fail2ban-regex | zcat /var/log/ningx/access.log* \
   /etc/fail2ban/filter.d/nginx-noscript.conf -v`

but it's not working. How can I pipe it the right way?


You are piping from fail2ban into the zcat.

Pipes run from left to right. You need to pipe the output of zcat to the input of fail2ban

zcat ... | fail2ban-regex ...
  • From the man page, I'm not sure if fail2ban-regex knows how to read from stdin by default (it expects a log entry as a string, or a log file path), so it may be necessary to use zcat access.log*.gz | fail2ban-regex /dev/stdin /etc/fail2ban/filter.d/nginx-noscript.conf
    – ilkkachu
    Jul 8 '18 at 9:03
  • It didn't work unfortunately. Jul 8 '18 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.