ConfigServer Community Forum

I want to block the ip after 5 400 return codes. Is that what you're asking?

Sergio, here is a line. Please note, though, that the length of the strings differ widely, as in this 1 is really long. I'm wanting to act on the return code. As indicated, it seems from my testing that my regexp should have worked, so I'm eager for an explanation as to why it didn't. Thank you for ...

Well, I made some additional changes, enclosing (400) and (404) in parentheses. regex101 divides the matches by IP, the irrelevant middle, and the return code correctly, but LFD doesn't seem to trigger. Unless I can come up w/something different, I guess I'll have to wait for Sergio :(. I tried. I'm...

I did some more studying & made some changes. I guess I'll see if what I did worked. My entry in regex.pm now looks as follows: if (($globlogs{CUSTOM1_LOG}{$lgfile}) and ($line =~ ^(\S+)\s+\S+\s\S+\s\S+\s\S+\s"([^"]*)"\s404\s { return ("NotFound from",$1,"NotFound&q...

So I'm an idiot. What can I say? I've set my customlog1 as follows: CUSTOM1_LOG = "/var/log/nginx/access_log" Yes, that is the correct path. The format looks like: 118.126.124.10 - - [16/Sep/2023:15:31:48 -0400] "HEAD /manager/html HTTP/1.1" 404 0 "-" "Python/3.6 a...