mssqld-auth.conf

# Fail2Ban filter for unsuccesfull MSSQL authentication attempts

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = mssqld

failregex = ^%(__prefix_line)s.*Login failed for user '[A-Za-z ]*'. Reason: .*provided. \[CLIENT: <HOST>\]

#failregex = ^%(__prefix_line)s.*Login failed for user '[A-Za-z ]*'. Reason: Password did not match that for the login >#Login failed for user 'sa'. Reason: Password did not match that for the login provided. [CLIENT: <HOST>]*\s*$

ignoreregex =