frpatte 2 Posted October 22, 2021 Share Posted October 22, 2021 Bonjour, I would like to add a "jail" in fail2ban for emby-server, is there something already done? Are there some log files about authentication in emby? Any suggestions on howto proceed? Thank you. F.P. Link to comment Share on other sites More sharing options...
CassTG 98 Posted October 22, 2021 Share Posted October 22, 2021 Hi I have just spent the weekend on this myself. You do not mention if you are in docker or if Emby is installed directly on the server, but i managed to get both working by taking parts of guides on here and the web ill explain how i achieved it in both my set ups Docker I use Linuxserver Swag proxy docker to manage ssl and reverse proxy, they have fail2ban built in i exec in to docker and goto - cd /config/fail2ban Then you need to create a new filter in filter.d folder nano emby.conf and in their paste this text # Fail2Ban for emby # # [Definition] failregex = AUTH-ERROR: <HOST> - Invalid user HTTP Response 401 to <HOST>. ignoreregex = Then to save and exit Ctrl o Ctrl x Now go back to main fail2ban folder and if you havent made a copy of jail.conf already: cp jail.conf jail.local Then edit jail.local and add the emby entry as follows at the bottom of the document nano jail.local add [emby] enabled = true filter = emby logpath = /config/log/emby/embyserver.txt port = 80,443,8096,8920 maxretry = 3 findtime = 10800 bantime = 864000 Now notice the logpath entry as that is key, if you are using docker and swag, you will need to map the emby log files to the fail2ban container you are using as a volume, you can adjust the find and bantimes to suit ServerSide If you are running emby directly on the server its pretty much the same but as follows (presuming you have installed fail2ban) cd /etc/fail2ban Follow the same steps as above in creating the filter in filter.d and also copy jail.conf to jail.local but use these settings for jail.local at the bottom [emby] enabled = true filter = emby logpath = /var/lib/docker/volumes/emby_data/_data/logs/embyserver.txt port = 8096 maxretry = 3 findtime = 1d bantime = 1d chain = DOCKER-USER banaction = iptables-allports Ports - You can add port 80 and 443 here also just seperate with a comma to the port section depending which ports you want blocked Log Path - Change the Log path to where on the server the embyserver.txt file is located Chain - If you are not using Docker you can delete this line Ban-action = I want someone who is trying to login to my server to be banned from all ports hence using iptables-allports, you can change this to just iptables which will ban access to the specific ports listed in ports section You do not mention which firewall you are using so heres where it gets tricky I use UFW in front of IPTABLES so this is basically inputting it direct into IPTABLES and it does not show in UFW. WHY? well UFW was not playing ball with blocking the correct chain so i just went direct to the IPTABLES and it works a treat 1 Link to comment Share on other sites More sharing options...
CassTG 98 Posted October 22, 2021 Share Posted October 22, 2021 FULL GUIDE THIS IS THE SECOND TIME TODAY THAT THIS FORUM BLOCKS AN EDIT STATING TOO MUCH TIME HAS PASSED AND MARKS IT AS UNEDITABLE Hi I have just spent the weekend on this myself. You do not mention if you are in docker or if Emby is installed directly on the server, but i managed to get both working by taking parts of guides on here and the web ill explain how i achieved it in both my set ups Docker I use Linuxserver Swag proxy docker to manage ssl and reverse proxy, they have fail2ban built in i exec in to docker and goto - cd /config/fail2ban Then you need to create a new filter in filter.d folder nano emby.conf and in their paste this text (credit - Original posts ) # Fail2Ban for emby # # [Definition] failregex = AUTH-ERROR: <HOST> - Invalid user HTTP Response 401 to <HOST>. ignoreregex = Then to save and exit Ctrl o Ctrl x Now go back to main fail2ban folder and if you havent made a copy of jail.conf already: cp jail.conf jail.local Then edit jail.local and add the emby entry as follows at the bottom of the document nano jail.local add [emby] enabled = true filter = emby logpath = /config/log/emby/embyserver.txt port = 80,443,8096,8920 maxretry = 3 findtime = 10800 bantime = 864000 Now notice the logpath entry as that is key, if you are using docker and swag, you will need to map the emby log files to the fail2ban container you are using as a volume, you can adjust the find and bantimes to suit ServerSide If you are running emby directly on the server its pretty much the same but as follows (presuming you have installed fail2ban) cd /etc/fail2ban Follow the same steps as above in creating the filter in filter.d and also copy jail.conf to jail.local but use these settings for jail.local at the bottom [emby] enabled = true filter = emby logpath = /var/lib/docker/volumes/emby_data/_data/logs/embyserver.txt port = 8096 maxretry = 3 findtime = 1d bantime = 1d chain = DOCKER-USER banaction = iptables-allports Ports - You can add port 80 and 443 here also just seperate with a comma to the port section depending which ports you want blocked Log Path - Change the Log path to where on the server the embyserver.txt file is located Chain - If you are not using Docker you can delete this line Ban-action = I want someone who is trying to login to my server to be banned from all ports hence using iptables-allports, you can change this to just iptables which will ban access to the specific ports listed in ports section or if you have set defaults at the top of this file you do not need to include You do not mention which firewall you are using so heres where it gets tricky I use UFW in front of IPTABLES so this is basically inputting it direct into IPTABLES and it does not show in UFW. WHY? well UFW was not playing ball with blocking the correct chain so i just went direct to the IPTABLES and it works a treat. DOCKER + UFW This is the additional steps to secure docker behind UFW. As anyone knows if you use UFW and block a docker port i.e 8096. You can still access it as the DOCKER-USER chain in iptables is loaded beforehand. I try and keep everything through my Swag Docker so only port 443 is exposed publicly. However if you do need docker ports open and use UFW, you should really change your setup so that you control the public ports available to docker To do this we need to reconfigure UFW nano /etc/ufw/after.rules and add this after the last commit line # BEGIN UFW AND DOCKER *filter :ufw-user-forward - [0:0] :ufw-docker-logging-deny - [0:0] :DOCKER-USER - [0:0] -A DOCKER-USER -j ufw-user-forward -A DOCKER-USER -j RETURN -s 10.0.0.0/8 -A DOCKER-USER -j RETURN -s 172.16.0.0/12 -A DOCKER-USER -j RETURN -s 192.168.0.0/16 -A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN -A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16 -A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8 -A DOCKER-USER -j ufw-docker-logging-deny -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12 -A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 192.168.0.0/16 -A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 10.0.0.0/8 -A DOCKER-USER -j ufw-docker-logging-deny -p udp -m udp --dport 0:32767 -d 172.16.0.0/12 -A DOCKER-USER -j RETURN -A ufw-docker-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW DOCKER BLOCK] " -A ufw-docker-logging-deny -j DROP COMMIT # END UFW AND DOCKER HOWEVER Adjust the 6 lines in the middle to match your docker network IP's, so if your docker network is for example 172.20.0.0/16 adjust both lines to match, include all docker networks you created the ips shown are example networks only and remember the /16 is required but adjust if your network is setup as /24 (normally /16 in docker) Now i found that a simple systemctl restart ufw was not sufficient enough for this change to be made. You have to reboot the server for it to really take affect reboot Now docker public ports will be restricted until you decide to open them We do this differently that creating a normal ufw open port by routing the port instead So lets take port 8096 for emby as an example If you want to open port 8096 to all docker network you would add ufw route allow proto tcp from any to any port 8096 However only emby is using that port so if you have set static IP's for Docker containers (why would't you) you can open that port for that one specific container So lets say you issued the emby docker with a static ip of 172.20.0.100 you would issue the command ufw route allow proto tcp from any to 172.20.0.100 port 8096 and then ufw reload for it too take effect To learn more about why you should do this when using docker and ufw visit Original info Footnote Now you can set UFW as the default banaction in the jail.local if you are using UFW and Emby direct (not in a docker) this is set near the top of the file in banaction, but leave banactions all ports to iptables-allports if you are using this kind of setup (i.e not docker) and only want the ban to be on the port affected, remove the banaction = iptables-allports from the bottom of the emby section in jail.local that way it will be blocked by UFW on that port only 1 Link to comment Share on other sites More sharing options...
CassTG 98 Posted October 22, 2021 Share Posted October 22, 2021 As i cannot edit it, a possible correction, if you only want to ban the ports specified and not all ports, you could use banaction = iptables-multiport instead. However i prefer the complete ban on all ports myself, if you cant remember the password then well thats on you lol Link to comment Share on other sites More sharing options...
frpatte 2 Posted October 22, 2021 Author Share Posted October 22, 2021 Thank you for your answer but I am a little bit confused about it. I have emby installed on a server without docker, so I can't refer to it: 54 minutes ago, CassTG said: logpath = /var/lib/docker/volumes/emby_data/_data/logs/embyserver.txt this path does not exist nor a chain named docker-user. As firewall, I use nftables. Thank you for helping. Link to comment Share on other sites More sharing options...
CassTG 98 Posted October 22, 2021 Share Posted October 22, 2021 24 minutes ago, frpatte said: Thank you for your answer but I am a little bit confused about it. I have emby installed on a server without docker, so I can't refer to it: this path does not exist nor a chain named docker-user. As firewall, I use nftables. Thank you for helping. Exactly that's why I said you need to find where on your server that log is. It will be some default path if its not in /var/log I also noted that if you are not using docker you can delete that line. Link to comment Share on other sites More sharing options...
CassTG 98 Posted October 22, 2021 Share Posted October 22, 2021 (edited) Your first post didn't mention how it was installed or firewall type hence doing both versions. You only need to refer to serverside section and the emby.conf filter.d section and ignore the rest. Also have to check in /etc/fail2ban/actions.d to see if there is a nftables.conf if there is then set banaction to that instead of iptables in jail.local Looks like there is nftables.conf and nftables-allports.conf in there so at the action section in the top of jail.local file change those two lines to match the nftables and nftables-allports So create the emby.conf as per first part of the guide in filter.d folder Copy jail.conf to jail.local then edit and Add the emby section at the bottom with the correct log path location , remove chain line and if u set default banactions as per previous paragraph you can also delete that line or leave it and change it to nftables or nftables-allports if u want the total ban. Edited October 22, 2021 by CassTG Link to comment Share on other sites More sharing options...
frpatte 2 Posted October 23, 2021 Author Share Posted October 23, 2021 OK! Thank you I got fail2ban working for emby. F.P. 1 Link to comment Share on other sites More sharing options...
Touz604 11 Posted August 5, 2022 Share Posted August 5, 2022 when trying to run a test on the Emby log file, I get back a Python error. Anyone has an idea what could be wrong here? root@f12caf6bf9ed:/# fail2ban-regex /log/EmbyServer/embyserver.txt /config/fail2ban/filter.d/EmbyServer Running tests ============= Use failregex filter file : EmbyServer, basedir: /config/fail2ban Use log file : /log/EmbyServer/embyserver.txt Use encoding : UTF-8 Traceback (most recent call last): File "/usr/bin/fail2ban-regex", line 34, in <module> exec_command_line() File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 836, in exec_command_line if not fail2banRegex.start(args): File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 776, in start self.process(test_lines) File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 584, in process line_datetimestripped, ret, is_ignored = self.testRegex(line) File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 456, in testRegex found = self._filter.processLine(line, date) File "/usr/lib/python3.9/site-packages/fail2ban/server/filter.py", line 613, in processLine timeMatch = self.dateDetector.matchTime(line) File "/usr/lib/python3.9/site-packages/fail2ban/server/datedetector.py", line 368, in matchTime (line[distance] == self.__lastPos[2] and not self.__lastPos[2].isalnum()) IndexError: string index out of range root@f12caf6bf9ed:/# When trying to trigger fail2ban by entering the wrong credentials, it seems like fail2ban is having a hard time to parse the log file (emberserver.txt). Did anyone ever experience this? Thanks 2022-08-05 16:15:39,973 fail2ban.filter [282]: WARNING [EmbyServer] Simulate NOW in operation since found time has too large deviation 1654873721.0 ~ 1659730539.973843 +/- 60 2022-08-05 16:15:39,974 fail2ban.filter [282]: WARNING [EmbyServer] Please check jail has possibly a timezone issue. Line with odd timestamp: Operating system: Linux version 5.15.46-Unraid (root@Develop) (gcc (GCC) 11.2.0, GNU ld version 2.37-slack15) #1 SMP Fri Jun 10 11:08:41 PDT 2022 2022-08-05 16:15:39,974 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:15:40,375 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:40 2022-08-05 16:15:41,974 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:15:42,981 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:42 2022-08-05 16:15:43,976 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:15:45,978 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:15:47,590 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:47 2022-08-05 16:15:47,980 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:15:49,594 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:48 2022-08-05 16:15:49,982 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:15:50,797 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:50 2022-08-05 16:15:50,970 fail2ban.actions [282]: NOTICE [nginx-unauthorized] Ban 87.101.92.171 2022-08-05 16:15:51,984 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:15:53,987 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:15:55,988 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:15:57,991 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:39.968 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:15:59,993 fail2ban.filter [282]: INFO [EmbyServer] Found 87.101.92.171 - 2022-08-05 16:15:40 2022-08-05 16:15:59,995 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:16:01,996 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:16:03,998 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:16:06,000 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:16:08,002 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:16:10,004 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:16:12,006 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:12,031 fail2ban.filter [282]: INFO [nginx-unauthorized] Ignore 192.168.20.1 by ip 2022-08-05 16:16:14,009 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:16:16,011 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:16:18,013 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:42.658 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:16:20,014 fail2ban.filter [282]: ERROR Failed to process line: "2022-08-05 16:15:42.793 Info App: ProcessRun 'extract-image' Process exited with code 0", caught exception: IndexError('string index out of range') 2022-08-05 16:16:22,016 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:42.795 Warn Server: AUTH-ERROR: 87.101.92.171 - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:24,018 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:42.795 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:26,022 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:16:28,024 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:16:30,026 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:16:32,028 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:16:34,030 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:16:36,032 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:16:38,034 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:40,037 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:16:42,040 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:16:44,041 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:47.257 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:16:46,043 fail2ban.filter [282]: ERROR Failed to process line: "2022-08-05 16:15:47.368 Info App: ProcessRun 'extract-image' Process exited with code 0", caught exception: IndexError('string index out of range') 2022-08-05 16:16:48,045 fail2ban.filter [282]: INFO [EmbyServer] Found 87.101.92.171 - 2022-08-05 16:16:48 2022-08-05 16:16:48,047 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:16:50,049 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:16:52,051 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:16:54,053 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:16:56,055 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:16:58,057 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:17:00,059 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:02,062 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:17:04,062 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:17:06,064 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:48.764 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:17:08,066 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:48.905 Warn Server: AUTH-ERROR: 87.101.92.171 - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:10,068 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:48.905 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:12,072 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:17:14,073 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:17:16,075 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:17:18,077 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:17:20,079 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:17:22,081 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:17:24,083 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:26,086 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:17:28,088 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:17:30,089 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:50.087 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:17:32,091 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:50.227 Warn Server: AUTH-ERROR: 87.101.92.171 - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:34,093 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:50.227 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') Link to comment Share on other sites More sharing options...
Luke 37008 Posted August 13, 2022 Share Posted August 13, 2022 On 8/5/2022 at 4:24 PM, Touz604 said: when trying to run a test on the Emby log file, I get back a Python error. Anyone has an idea what could be wrong here? root@f12caf6bf9ed:/# fail2ban-regex /log/EmbyServer/embyserver.txt /config/fail2ban/filter.d/EmbyServer Running tests ============= Use failregex filter file : EmbyServer, basedir: /config/fail2ban Use log file : /log/EmbyServer/embyserver.txt Use encoding : UTF-8 Traceback (most recent call last): File "/usr/bin/fail2ban-regex", line 34, in <module> exec_command_line() File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 836, in exec_command_line if not fail2banRegex.start(args): File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 776, in start self.process(test_lines) File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 584, in process line_datetimestripped, ret, is_ignored = self.testRegex(line) File "/usr/lib/python3.9/site-packages/fail2ban/client/fail2banregex.py", line 456, in testRegex found = self._filter.processLine(line, date) File "/usr/lib/python3.9/site-packages/fail2ban/server/filter.py", line 613, in processLine timeMatch = self.dateDetector.matchTime(line) File "/usr/lib/python3.9/site-packages/fail2ban/server/datedetector.py", line 368, in matchTime (line[distance] == self.__lastPos[2] and not self.__lastPos[2].isalnum()) IndexError: string index out of range root@f12caf6bf9ed:/# When trying to trigger fail2ban by entering the wrong credentials, it seems like fail2ban is having a hard time to parse the log file (emberserver.txt). Did anyone ever experience this? Thanks 2022-08-05 16:15:39,973 fail2ban.filter [282]: WARNING [EmbyServer] Simulate NOW in operation since found time has too large deviation 1654873721.0 ~ 1659730539.973843 +/- 60 2022-08-05 16:15:39,974 fail2ban.filter [282]: WARNING [EmbyServer] Please check jail has possibly a timezone issue. Line with odd timestamp: Operating system: Linux version 5.15.46-Unraid (root@Develop) (gcc (GCC) 11.2.0, GNU ld version 2.37-slack15) #1 SMP Fri Jun 10 11:08:41 PDT 2022 2022-08-05 16:15:39,974 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:15:40,375 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:40 2022-08-05 16:15:41,974 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:15:42,981 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:42 2022-08-05 16:15:43,976 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:15:45,978 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:15:47,590 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:47 2022-08-05 16:15:47,980 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:15:49,594 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:48 2022-08-05 16:15:49,982 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:15:50,797 fail2ban.filter [282]: INFO [nginx-unauthorized] Found 87.101.92.171 - 2022-08-05 16:15:50 2022-08-05 16:15:50,970 fail2ban.actions [282]: NOTICE [nginx-unauthorized] Ban 87.101.92.171 2022-08-05 16:15:51,984 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:15:53,987 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:15:55,988 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:15:57,991 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:39.968 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:15:59,993 fail2ban.filter [282]: INFO [EmbyServer] Found 87.101.92.171 - 2022-08-05 16:15:40 2022-08-05 16:15:59,995 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:16:01,996 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:16:03,998 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:16:06,000 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:16:08,002 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:16:10,004 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:16:12,006 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:12,031 fail2ban.filter [282]: INFO [nginx-unauthorized] Ignore 192.168.20.1 by ip 2022-08-05 16:16:14,009 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:16:16,011 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:16:18,013 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:42.658 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:16:20,014 fail2ban.filter [282]: ERROR Failed to process line: "2022-08-05 16:15:42.793 Info App: ProcessRun 'extract-image' Process exited with code 0", caught exception: IndexError('string index out of range') 2022-08-05 16:16:22,016 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:42.795 Warn Server: AUTH-ERROR: 87.101.92.171 - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:24,018 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:42.795 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:26,022 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:16:28,024 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:16:30,026 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:16:32,028 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:16:34,030 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:16:36,032 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:16:38,034 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:16:40,037 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:16:42,040 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:16:44,041 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:47.257 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:16:46,043 fail2ban.filter [282]: ERROR Failed to process line: "2022-08-05 16:15:47.368 Info App: ProcessRun 'extract-image' Process exited with code 0", caught exception: IndexError('string index out of range') 2022-08-05 16:16:48,045 fail2ban.filter [282]: INFO [EmbyServer] Found 87.101.92.171 - 2022-08-05 16:16:48 2022-08-05 16:16:48,047 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:16:50,049 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:16:52,051 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:16:54,053 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:16:56,055 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:16:58,057 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:17:00,059 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:02,062 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:17:04,062 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:17:06,064 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:48.764 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:17:08,066 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:48.905 Warn Server: AUTH-ERROR: 87.101.92.171 - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:10,068 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:48.905 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:12,072 fail2ban.filter [282]: ERROR Failed to process line: '\tFramework: .NET Core 3.1.21', caught exception: IndexError('string index out of range') 2022-08-05 16:17:14,073 fail2ban.filter [282]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-05 16:17:16,075 fail2ban.filter [282]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-05 16:17:18,077 fail2ban.filter [282]: ERROR Failed to process line: '\tProcessor count: 8', caught exception: IndexError('string index out of range') 2022-08-05 16:17:20,079 fail2ban.filter [282]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-05 16:17:22,081 fail2ban.filter [282]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-05 16:17:24,083 fail2ban.filter [282]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:26,086 fail2ban.filter [282]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-05 16:17:28,088 fail2ban.filter [282]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-05 16:17:30,089 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:50.087 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-05 16:17:32,091 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:50.227 Warn Server: AUTH-ERROR: 87.101.92.171 - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-05 16:17:34,093 fail2ban.filter [282]: ERROR Failed to process line: '2022-08-05 16:15:50.227 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') hi @Touz604, were you able to solve this? Link to comment Share on other sites More sharing options...
frpatte 2 Posted August 13, 2022 Author Share Posted August 13, 2022 For me the file /log/EmbyServer/embyserver.txt does not exist. I have in /etc/fail2ban/jail.local these lines: [emby] enabled = true filter = emby logpath = /var/lib/emby/logs/embyserver.txt port = 8096,8920 And it works ie. after 3 wrong attempts to login, the IP is banned. F.P. 1 Link to comment Share on other sites More sharing options...
Touz604 11 Posted August 15, 2022 Share Posted August 15, 2022 On 13/08/2022 at 08:25, frpatte said: For me the file /log/EmbyServer/embyserver.txt does not exist. I have in /etc/fail2ban/jail.local these lines: [emby] enabled = true filter = emby logpath = /var/lib/emby/logs/embyserver.txt port = 8096,8920 And it works ie. after 3 wrong attempts to login, the IP is banned. F.P. /log/EmbyServer/ is the path mapped inside the SWAG (NGINX) container. The log file is located at ../EmbyServer/logs for the container. On 12/08/2022 at 22:24, Luke said: hi @Touz604, were you able to solve this? No, I didn't get around to play with it again. I just tested in again and I still get the same behavior. Link to comment Share on other sites More sharing options...
Luke 37008 Posted August 15, 2022 Share Posted August 15, 2022 16 hours ago, Touz604 said: /log/EmbyServer/ is the path mapped inside the SWAG (NGINX) container. The log file is located at ../EmbyServer/logs for the container. No, I didn't get around to play with it again. I just tested in again and I still get the same behavior. The log file always exists while the server is running. Link to comment Share on other sites More sharing options...
MrMackey 26 Posted August 17, 2022 Share Posted August 17, 2022 (edited) On 10/22/2021 at 5:09 PM, CassTG said: Now notice the logpath entry as that is key, if you are using docker and swag, you will need to map the emby log files to the fail2ban container you are using as a volume, you can adjust the find and bantimes to suit I use Unraid with SWAG. Unfortunately, I don't know exactly how to do it. Do I have to enter something in the SWAG Docker template? ok I think I figured it out but I have a similar problem like Touz604 2022-08-18 05:17:56,874 fail2ban.filter [374]: ERROR Failed to process line: '2022-08-18 05:15:19.546 Warn Server: AUTH-ERROR: xx.xx.xxx.xx - Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-18 05:17:58,875 fail2ban.filter [374]: ERROR Failed to process line: '2022-08-18 05:15:19.546 Error Server: Invalid username or password entered.', caught exception: IndexError('string index out of range') 2022-08-18 05:18:00,883 fail2ban.filter [374]: ERROR Failed to process line: '\tFramework: .NET 6.0.2', caught exception: IndexError('string index out of range') 2022-08-18 05:18:02,886 fail2ban.filter [374]: ERROR Failed to process line: '\tOS/Process: x64/x64', caught exception: IndexError('string index out of range') 2022-08-18 05:18:04,888 fail2ban.filter [374]: ERROR Failed to process line: '\tRuntime: system/System.Private.CoreLib.dll', caught exception: IndexError('string index out of range') 2022-08-18 05:18:06,890 fail2ban.filter [374]: ERROR Failed to process line: '\tProcessor count: 4', caught exception: IndexError('string index out of range') 2022-08-18 05:18:08,891 fail2ban.filter [374]: ERROR Failed to process line: '\tData path: /config', caught exception: IndexError('string index out of range') 2022-08-18 05:18:10,894 fail2ban.filter [374]: ERROR Failed to process line: '\tApplication path: /system', caught exception: IndexError('string index out of range') 2022-08-18 05:18:12,896 fail2ban.filter [374]: ERROR Failed to process line: '\tSystem.Exception: System.Exception: Invalid username or password.', caught exception: IndexError('string index out of range') 2022-08-18 05:18:14,900 fail2ban.filter [374]: ERROR Failed to process line: '\tSource: Emby.Server.Implementations', caught exception: IndexError('string index out of range') 2022-08-18 05:18:16,904 fail2ban.filter [374]: ERROR Failed to process line: '\t', caught exception: IndexError('string index out of range') 2022-08-18 05:18:18,906 fail2ban.filter [374]: ERROR Failed to process line: '2022-08-18 05:16:23.651 Info HttpClient: POST https://connect.emby.media/service/user/authenticate', caught exception: IndexError('string index out of range') 2022-08-18 05:18:20,908 fail2ban.filter [374]: ERROR Failed to process line: '2022-08-18 05:16:24.018 Warn Server: AUTH-ERROR: xx.xx.xxx.xx - Invalid username or password entered.', caught exception: IndexError('string index out of range') Edited August 18, 2022 by MrMackey Link to comment Share on other sites More sharing options...
CassTG 98 Posted August 18, 2022 Share Posted August 18, 2022 (edited) When you are setting up the swag docker are you also mapping the emby Log file? I.e -v /var/lib/docker/volumes/emby_data/_data/logs:/config/log/emby:ro \ Explanation: -v = Volume mapping /var/lib/docker/volumes/emby_data/_data/logs = the path on your host server to Emby log file /config/log/emby:ro = where in the swag doocker are you mapping the log folder this is the location you use in fail2ban You need to map the file into the docker otherwise the internal path is worthless. I also use the swag fail2ban as a backup as i found it hit and miss, so use F2B on the server direct, but to do that you have to follow the UFW guide in my signature as docker bypasses all standard UFW rules and you have to make a few adjustments but at the end of it you have a more secure server as well as being able to use direct links to the log files And another thing to note, is if there is no emby log files at all, then fail2ban will not start and errors out, i clear my logs via cron several times a day so it does happen but i have a cron set to restart it Edited August 18, 2022 by CassTG Link to comment Share on other sites More sharing options...
MrMackey 26 Posted August 18, 2022 Share Posted August 18, 2022 I think that everything is correctly entered. I did it the same way as with nexcloud and there it worked. Unfortunately I don't know what else could be the reason Link to comment Share on other sites More sharing options...
CassTG 98 Posted August 19, 2022 Share Posted August 19, 2022 Lets rule out permissions issue (Unraid is a right pain at times), Exec into the docker so you are in the command line of the swag docker, and then enter: touch /emby/canyouseeme.txt go back to unraid and see if that file is written in /m,nt/cache/appdata/EmbyServer/logs/ 1 Link to comment Share on other sites More sharing options...
MrMackey 26 Posted August 19, 2022 Share Posted August 19, 2022 (edited) @CassTG Thank you for your help! I ran the command and it worked. In the Unraid forum, someone had the following assumption about this: Fail2ban seems to have a bug and can't handle the \t (tabulator) character. So you would have to report fail2ban. And emby you could report that no sign lands in the logs. Edited August 19, 2022 by MrMackey Link to comment Share on other sites More sharing options...
CassTG 98 Posted August 20, 2022 Share Posted August 20, 2022 To be honest i think is more to do with something within the setup or swag docker. In Swag docker it highlights these errors and then removes emby from the monitoring process. However this does not occur on F2B on the host server, the -T error does appear for some dockers here but not emby I just banned myself as a test and it worked as expected and here were the results: Swag Docker - No ban as it's version of F2B had removed emby from monitoring due to the parsing errors Host Server - The main version of F2B blocked and banned the Ip as expected Both F2B are running the exact same jails and reviewing the exact same logs. Historically both instances of F2B blocked the IP's so it is definetly nothing todo with Emby Logs or jail setups but something specific happening in Linuxservers Swag Docker. Have not compared F2b Versions between the two however will check that later 1 Link to comment Share on other sites More sharing options...
MrMackey 26 Posted August 22, 2022 Share Posted August 22, 2022 Would it be useful to report the problem here? https://github.com/linuxserver/docker-swag/issues Link to comment Share on other sites More sharing options...
CassTG 98 Posted August 22, 2022 Share Posted August 22, 2022 2 hours ago, MrMackey said: Would it be useful to report the problem here? https://github.com/linuxserver/docker-swag/issues Yes or their discord, their discord is pretty active. Link to comment Share on other sites More sharing options...
MrMackey 26 Posted August 22, 2022 Share Posted August 22, 2022 Hey CassTG I was told I should try the following config but it doesn't work for me either ## Version 2022/08/06 # Fail2Ban filter for emby [INCLUDES] before = common.conf [Definition] _daemon = emby-server failregex = ^.*Info HttpServer: HTTP Response 401 to <HOST>.*authenticatebyname.*$ ^.*Info HttpServer: HTTP Response 500 to <HOST>.*mediabrowser/Users/None.*$ ignoreregex = # DEV Notes: # # Matching on http 401 with a trailing url including 'authenticatebyname' to catch incorrect passwords # Matching on http 500 with a trailing url including 'mediabrowser/Users/None' to catch incorrect usernames # # Author: everydayevil@everydayevil.com Link to comment Share on other sites More sharing options...
jelum 17 Posted September 16, 2022 Share Posted September 16, 2022 Following config for emby.conf filter worked for me: [Definition] datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S.%%f failregex = ^.*AUTH-ERROR: <HOST> - Invalid user.*$ ^.*HTTP Response 401 to <HOST>\..*$ ignoreregex = The important part - datepattern and ^ sign 1 Link to comment Share on other sites More sharing options...
MrMackey 26 Posted September 16, 2022 Share Posted September 16, 2022 @jelumThank you sir That's it! I was able to ban myself successfully Link to comment Share on other sites More sharing options...
Touz604 11 Posted September 16, 2022 Share Posted September 16, 2022 2 hours ago, jelum said: Following config for emby.conf filter worked for me: [Definition] datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S.%%f failregex = ^.*AUTH-ERROR: <HOST> - Invalid user.*$ ^.*HTTP Response 401 to <HOST>\..*$ ignoreregex = The important part - datepattern and ^ sign thank you so much, it is indeed now working! Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now