Update: refine regex pattern for brute force protection log parsing in analyzer configuration

Failed attempts were not recorded if the user was not registered in the system.
This commit is contained in:
2026-08-09 19:16:02 +05:00
parent 95aec171e0
commit 8c10ab0e62
@@ -29,14 +29,14 @@ func NewBruteForceProtectionSSH(isNotify bool, notifyCooldown int, notifyEvery i
Patterns: []brute_force_protection.RegexPattern{
{
Regexp: regular_expression.NewLazyRegexp(`^Failed password for (\S+) from (\S+) port \S+`),
Regexp: regular_expression.NewLazyRegexp(`^Failed password for (invalid user |illegal user )?(\S*) from (\S+)( port \S+ \S+\s*)`),
Values: []brute_force_protection.PatternValue{
{
Name: i18n.Lang.T("user"),
Value: 1,
Value: 2,
},
},
IP: 2,
IP: 3,
},
},
Group: group,