Hey Guys,

 I've been trying to solve this myself for a while. Basically, I want the IP from this line for fail2ban. IP's are defined as <HOST>. Here is the log file,

 [2009-11-29 16:27:23] VERBOSE[15851] logger.c:     -- Executing [011442076369991@from-sip-external:1] NoOp("SIP/113.105.152.62-08b0bb58", "Received incoming SIP connection from unknown peer to 011442076369991") in new stack

A note from the fail2ban config file

 # Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>\S+)

and what I've tryed, that did not work, or atleast where I left them after screwing around with them all day.

 from-(?:iax2|sip)-external+(?<host>(?:\d{1,3}\.){3}(?:\d{1,3}))?\s*

  logger.c:.*-- Executing [.*@from-sip-external:1] NoOp("SIP/<HOST>-.*", "Received incoming SIP connection from unknown peer to .*") in new stack

 I think the date is stripped automatically off the front, as the other examples in the fail2ban config do not have the date infront.

 failregex = NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Wrong password
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - No matching peer found
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Username/auth name mismatch
            NOTICE.* .*: Registration from '.*' failed for '<HOST>' - Device does not match ACL
            NOTICE.* <HOST> failed to authenticate as '.*'$
            NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
            NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' (.*)

I hate asking for help, but I don't know what to do. I've always had a hard time with regex, and all the manuals are sold in volumes!

Any direction would be great!

 from what I see, \s at the end of the regular expressionwould attempt to match a [\n\t\r\v ] whatever blanks is setup.

from-(?:iax2|sip)-external+(?<host>(?:\d{1,3}\.){3}(?:\d{1,3}))?\s

 does not match the string "-08b0bb58" at the end of the IP address, but I am not sure if this is a display artefact on the text to be matched by a regular expression.

SIP/113.105.152.62<b>-08b0bb58</b>

There are more secure ways to match an IP address, like ensuring there are no more digits after an IP address, with a lookahead assertion if your regular expression engine supports.

(?:\d{1,3}\.){3}(?:\d{1,3}(?=[^\d]))

It does not look like fail2ban is using a standard regular expression match engine, please contact the software support of fail2ban for help about their config file.