In my access.log I got somerow a

ip - - [date] method link ... etc..

and some others with

www.domain.com:ip - - [date] method link ... etc..

I am actually using this regexp


The problem is that It causes that fail2ban uses as ip the reverse lookup of www.domain.com when parsing the second kind of rows.

Is there a more precise regexp for ip and not host name?

1 Answer 1


I think you want to tell fail2ban to not do hostname lookups.

yes   (current behavior)
warn  (uses but warns upon each dns lookup)
no    (no DNS lookup, no warnings, INFO-LEVEL log messages when
       rDNS was necessary and entry was ignored because of that)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.