I'm running Debian Linux. uname --all shows:Linux xxx.xx 2.6.32-5-686 #1 SMP Tue May 13 16:33:32 UTC 2014 i686 GNU/LinuxI'm running sshd on a port that is not 22.  I've updated /etc/fail2ban/jail.local to point to the new sshd port.  It works fine.  I can try and login to that port with an ssh client, enter the wrong password several times, then it locks that IP address out via iptables.However, I am also running an apache webserver, that gets hit all the time with attempts like this (from /var/log/apache2/error.log):[Sun Nov 02 08:03:13 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/muieblackcat[Sun Nov 02 08:03:14 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/phpMyAdmin[Sun Nov 02 08:03:16 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/phpmyadmin[Sun Nov 02 08:03:16 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/pma[Sun Nov 02 08:03:16 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/myadmin[Sun Nov 02 08:03:17 2014] [error] [client 178.239.62.113] File does not exist: /var/www/html/MyAdminI was trying to setup fail2ban to read error.log and ban the offending IP addresses via iptables, but I can't get it to work.Like I said, it works great for ssh, but not for apache.  Here is my jail.local:[DEFAULT]# ignoreip can be an IP address, a CIDR mask or a DNS hostignoreip = 127.0.0.1/8 67.159.128.0/19# bantime = 21600 == 6 hoursbantime  = 21600#findtime, in seconds.  300 = 5 minutes, 10800 = 3 hoursfindtime = 10800maxretry = 3# backend specifies the backend used to get files modification. Available# options are gamin, polling and auto.# yoh: For some reason Debian shipped python-gamin didn't work as expected#      This issue left ToDo, so polling is default backend for nowbackend = auto## Destination email address used solely for the interpolations in# jail.{conf,local} configuration files.destemail = root@localhost## ACTIONS## Default banning action (e.g. iptables, iptables-new,# iptables-multiport, shorewall, etc) It is used to define # action_* variables. Can be overriden globally or per # section within jail.local filebanaction = iptables-multiport# email action. Since 0.8.1 upstream fail2ban uses sendmail# MTA for the mailing. Change mta configuration parameter to mail# if you want to revert to conventional 'mail'.mta = sendmail# Default protocolprotocol = tcp## Action shortcuts. To be used to define action parameter# The simplest action to take: ban onlyaction_ = %(banaction)s[name=%(__name__)s, port=%(port)s, protocol=%(protocol)s]# ban & send an e-mail with whois report to the destemail.action_mw = %(banaction)s[name=%(__name__)s, port=%(port)s, protocol=%(protocol)s]          %(mta)s-whois[name=%(__name__)s, dest=%(destemail)s, protocol=%(protocol)s]# ban & send an e-mail with whois report and relevant log lines# to the destemail.action_mwl = %(banaction)s[name=%(__name__)s, port=%(port)s, protocol=%(protocol)s]           %(mta)s-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s]# Choose default action.  To change, just override value of 'action' with the# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in     jail.local# globally (section [DEFAULT]) or per specific section action = %(action_)s## JAILS## Next jails corresponds to the standard configuration in Fail2ban 0.6 which# was shipped in Debian. Enable any defined here jail by including## [SECTION_NAME] # enabled = true## in /etc/fail2ban/jail.local.## Optionally you may override any other parameter (e.g. banaction,# action, port, logpath, etc) in that section within jail.local# we are banning port xxxxx instead of ssh because I use port xxxxx instead[ssh]enabled = trueport    = xxxxxfilter  = sshdlogpath  = /var/log/auth.logfindtime = 300maxretry = 4## HTTP servers#[apache]enabled = trueport    = http,httpsfilter  = apache-authlogpath = /var/log/apache2/*error.logfindtime = 10800maxretry = 3# default action is now multiport, so apache-multiport jail was left# for compatibility with previous (<0.7.6-2) releases[apache-multiport]enabled   = trueport      = http,httpsfilter    = apache-authlogpath   = /var/log/apache2/*error.logfindtime = 300maxretry  = 3[apache-noscript]enabled = trueport    = http,httpsfilter  = apache-noscriptlogpath = /var/log/apache2/*error.logfindtime = 300maxretry = 4[apache-overflows]enabled = trueport    = http,httpsfilter  = apache-overflowslogpath = /var/log/apache2/*error.logfindtime = 300maxretry = 2[apache-misc]enabled = trueport = http,httpsfilter = apache-misclogpath = /var/log/apache2/*error.logfindtime = 10800maxretry = 2Here is my /etc/fail2ban/apache-misc file:[Definition]failregex = <HOST>.*[A-Z]* /(cms|user|muieblackcat|db|cpcommerce|wp-login|joomla|    awstatstotals|wp-content|wp-includes|pma|phpmyadmin|myadmin|mysql|mysqladmin|sqladmin|    mypma|admin|xampp|mysqldb|pmadb|phpmyadmin1|phpmyadmin2).*        <HOST>.*\ (502|500|417|416|415|414|413|412|404|405|403|401|400)ignoreregex = .*\GET \/(press|mailto|domestic|word).*Can anyone offer any suggestions?
fail2ban works fine on bad SSH attempts, but fails on bad Apache2 attempts
apache httpd;fail2ban