ConfigServer Community Forum

Hello Sergio,

I do have to agree that my per regex experience is not great ;-)

Yours are a bit too specific. We don't really care about the page or path just the "-" "-" at the end. Would something like:
Work?

We are trying to block access to a web server when there is no user agent and not referrer. Example log lines look like this; 40.##.##.## - - [20/Apr/2025:08:39:37 -0500] "GET /wp-admin/css/colors/Admin-Author.php HTTP/1.1" 500 17551 "-" "-" The code we put in regex.cus...

Hello, We'd like to use the LF_APACHE_404 option to block IP's getting multiple 404 errors. The issue is it appears to be based on HTACCESS_LOG and that is set to /usr/local/apache/logs/error_log. Even if that was pointing at the access log, it's the main Apache log, not the hosted site logs. What w...

Hello,

Thanks for the suggestion. I'd rather not send them in the first place so our mail server does not have to process them.

Hello,

We'd like to disable the email alerts for certain types of alerts. For example, we don't need an email when there is a POP/IMAP/SMTP login failure, as it's easy to search the logs for there.

Thanks!

We have a few resellers setup as follows: XXXXXX:1:USE,UNBLOCK,GREP After the upgrade to 9.x they try to unblock but it does not actually work. On the web page they get the CSF manpage. In the email we get the search for the IP, it not getting unblocked and then the CSF manpage. Thanks for looking i...

Hello, Thanks. We're not really looking to disable the login method, just not block the users. We found that there is a specific regex for these failed logins in lfd, so it does not look like there is any way to bypass this 'error'. It's a tad frustrating as we get a lot of tickets for people blocke...

Hello Guys, We're seeing an increasing number of IP's getting blocked for 'aborted' logins. The messages look like: May 17 12:52:25 ### dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<###>, method=PLAIN, rip=###, lip=###, TLS, session=<###> May 17 12:52:31 ### dovecot: ...

Hello Sarah,

Thank you very much

Hello, CXS 'seems' to have identified this, but for some reason it's not getting quarantined. We've looked over the settings and we must just be missing it. Why isn't this getting quarantined? Scanning FTP file... Time : Tue Jan 15 07:07:35 2013 -0600 FTP user : ##### FTP file : /home/#####/public_h...