On my system (Debian 7) the day is padded with a space when the day is a single digit.
Then this line #262 in RegexMain.pm will not match:
Code: Select all
Might be a typo. It works for all two digit days.if (($config{LF_FTPD}) and ($globlogs{FTPD_LOG}{$lgfile}) and ($line =~ /^\S+ \S+ \d+ \S+ \d+ \[pid \d+] \[(\S+)\] FAIL LOGIN: Client "(\S+)"/)) {
I changed it like that and it works:
Code: Select all
Example:
^\S+ \S+\s+\d+ \S+ \d+ \[pid \d+] \[(\S+)\] FAIL LOGIN: Client "(\S+)"
Code: Select all
does not match:
Wed Nov 2 16:33:56 2016 [pid 1] [usrname] FAIL LOGIN: Client "0.0.0.0"
works:
Wed Oct 31 16:33:56 2016 [pid 1] [usrname] FAIL LOGIN: Client "0.0.0.0"