[INCLUDES]

before = common.conf

[Definition]

failregex = ^.*Unsuccessful (1FA|TOTP|Duo|U2F) authentication attempt by user .*remote_ip="?<HOST>"? stack.*
            (?i)^.*access to .*is not authorized.*remote_ip=<HOST>
            ^.* is banned until .*remote_ip=<HOST> stack.*

ignoreregex = ^.*level=debug.*
              ^.*level=info.*
              ^.*level=warning.*