NPM changed its log format. Old filters expected classic nginx format:
PROXY_IP - - [date] "METHOD PATH" STATUS BYTES "REF" "UA" [Client IP]
Actual current format:
[date] - STATUS STATUS - METHOD SCHEME HOST "PATH" [Client IP] [Length N] [Gzip N] [Sent-to IP] "UA" "REFERER"
fail2ban strips the timestamp before applying failregex, so patterns
must match the post-strip line (no ^ timestamp prefix).
All three filters updated: http-errors, npm-probe, badbot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
gitea
572e8bbe4e