AI fail2ban Regex Generator: Filters and Jails from Log Lines

This fail2ban regex generator writes the filter and jail from real log lines. Paste a few lines that show the abuse — failed SSH logins, WordPress login floods, Dovecot authentication failures, 404 scans — and describe the ban policy. You get a filter file with an anchored failregex using the tag, a jail file and the fail2ban-regex command that proves it matches.

Anchored patterns matter: a loose regex can ban your own monitoring or never match at all, and a greedy one can slow fail2ban down on busy logs.

How to use the fail2ban regex generator

1. Paste three to ten sample log lines that should trigger a ban.
2. Optionally set the ban policy and the log path.
3. Press Generate filter, save the two files and run the fail2ban-regex test before reloading.

What you get

• filter.d/NAME.conf with failregex and a datepattern when needed.
• jail.d/NAME.local with maxretry, findtime, bantime and logpath.
• The fail2ban-regex test command and how to reload and check the jail.
• A plain PCRE version of the regex for other tools.

Worked example

Example: you paste Dovecot lines such as “auth failed, 1 attempts … rip=198.51.100.7”. The generator returns a filter anchored on the Dovecot prefix with rip=, a jail that bans after five failures in ten minutes for an hour on the mail log, and the fail2ban-regex command that shows how many lines match.

Tips for better answers

• Include one line that should not match so the regex can be made precise.
• Pair bans with the AI firewall rule builder for permanent blocks.

Related guide: replace CSF with firewalld and fail2ban.

Privacy and limits

Before anything is sent, srvScripts removes private keys, passwords, tokens and API keys it recognises. With the box ticked it also swaps public IP addresses and e-mail addresses for placeholders, which lowers the risk when you paste real logs. The masking is automatic and best effort: it can miss names, hostnames, keys or other customer details, so remove anything confidential before you paste. Your text goes to our AI provider only to write the answer. srvScripts does not save your input as a record of its own, but the masked input is sent to the AI provider to produce the answer, and the answer, which can quote parts of your input, is cached on our server for 24 hours so a repeat question is answered instantly, and is then deleted. The provider’s own API data terms apply to what it receives. Without an account you get 5 runs a day, a free account gets 15 and srvScripts Pro 200, with larger inputs.

Official documentation: fail2ban project, PCRE2 documentation and the journalctl manual.

Frequently asked questions