Fail2ban-Regex test always tells no host in group

Question

I'm trying to build a filter myself using regex. This is a line i want to filter for example:

Aug 30 11:07:38 *** postfix/smtpd[17969]: connect from vps10685425.123-vps.co.uk[46.32.239.160]

An this is my RegEx currently:

^%(__prefix_line).*:.*connect from.*\[<HOST>\].*$
^%(__prefix_line)s\w{14}:.*connect from[-._\w]+\[<HOST>\].*$

Both lines tell me

server.failregex.RegexException: No 'host' group in '/etc/fail2ban/filter.d/smtp-auth.conf'

Why does fail2ban fail to recognize the host group in my regex? what am I doing wrong here?

Thanks in advance :)

Did you try running fail2ban-regex in the command line? I did it with your log example and first regex and didn't get the host group error. — Paulo Almeida, Aug 30 '16 at 10:25
Yes, the message occurs with the `fail2ban-regex` command but I added the mail.log and my config file. Maybe there is a problem with the config file? — mike.b93, Aug 30 '16 at 10:33
sheeeesh I'm with stupid here... I had a typo in my .conf file.. — mike.b93, Aug 30 '16 at 10:45

score 4 · Accepted Answer · answered Aug 30 '16 at 10:46

4

OK, abort mission. I'm the stupid one..

Got a Typo in my parameters... it is actually smtp_auth.conf not smtp-auth.conf

Sorry! Close this one and burry it deep -.-'

answered Aug 30 '16 at 10:46

mike.b93

3

This actually helped me - the error message by fail2ban-regex does not explicitely say that the filter file does not exist, so I didn't notice at first that I uploaded the filter to the wrong server :-D – iquito Feb 26 '17 at 22:41

1 Answers1