Mitchell Krog

Try this ... BUT test it thoroughly on a live site. ``` [Definition] failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*([.-]cgi)?|\.asp|\.exe|\.pl)(, referer:...

Make sure to reload fail2ban after that change so the new filter change is loaded.

Post your jail settings for this filter. How many times did you simulate the attack?

Hi @lou-diamonds unfortunately this has never been tested in conjunction with the asterisk filter so I guess they could very well conflict with each other. @juniorionut are you using this...

When asterisk unbans them are they removed from ip.blacklist ?? Maybe the default findtime + asterisk is conflicting with the findtime specified in [blacklist] ? :thinking: Another question, are the...

Oh great @juniorionut please post your solution in case any others run into it.

If your findtime is set to 1 month (for example) and a bad IP has stopped attacks after 1 month it will be unbanned and removed and not re added....

Hi @ghanavat yes it is, my apologies I have been so tied down with other projects. Please can you post your jail.local config

@ghanavat just a quick question have you tested the commands `sort` and `cat` from the command line to make sure they exist?

Thanks for the feedback @ghanavat was worth checking that to rule them out. When you copied the action and filter files from the repo did you make sure you copied...