title: Create fail2ban custom rule for Apache2
body: <p>I am trying to create a custom rule to ban users trying to log in too many times. Trigger is the word "<code>CheckLogin</code>" in the apache log file.</p>
  
  <p>Log extract:</p>
  
  <pre><code>[03/Mar/2016:19:38:24 -0600] 186.77.136.133 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "POST /CheckLogin HTTP/1.1" -
  [03/Mar/2016:19:38:24 -0600] 186.77.136.133 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "GET /Login?nok=badpassword HTTP/1.1" 10570
  [03/Mar/2016:19:38:27 -0600] 186.77.136.133 TLSv1.2 ECDHE-RSA-AES128-
  </code></pre>
  
  <p>Current filter : <code>/etc/fail2ban/filter.d/test.conf</code>:</p>
  
  <pre><code>[INCLUDES]
  [Definition]
  failregex = ^&lt;HOST&gt; -.*"(GET|POST|HEAD).*CheckLogin".*$
  ignoreregex =
  </code></pre>
  
  <p>Current <code>jail.local</code>:</p>
  
  <pre><code># detect password authentication failures
  [test-auth-ssl]
  enabled  = true
  port     = https
  filter   = test
  logpath  = /var/log/apache2/ssl_request_log
  maxretry = 3
  bantime  = 36000  ; 10 hrs
  findtime = 360   ; 
  
  
  [test-auth]
  enabled  = true
  port     = http
  filter   = test
  logpath  = /var/log/apache2/access_log
  maxretry = 3
  bantime  = 36000  ; 10 hrs
  findtime = 360   ; 
  </code></pre>
  
  <p>Must be a tricky detail in the filter failregex, but I tried various option and none worked. I can restart fail2ban without error, but external IP used for testing is never banned (trigger deos not work).</p>
  
  <pre><code>Status for the jail: test-auth-ssl
  |- Filter
  |  |- Currently failed: 0
  |  |- Total failed:     0
  |  `- Journal matches:
  `- Actions
     |- Currently banned: 0
     |- Total banned:     0
     `- Banned IP list:
  </code></pre>