正则表达式太难了 ..怎么破

• 请不要在回答技术问题时复制粘贴 AI 生成的内容

This topic created in 2629 days ago, the information mentioned may be changed or developed.

找了半天都没找出问题
求 V 友帮忙看看指点一下谢谢!

log 如下 :

Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error

正规表达式如下:
failregex = ^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$

手动测试无法匹配到

# fail2ban-regex 'Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error' '^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s+failed to handshake with <HOST>: authentication error$'

Running tests
=============

Use failregex line : ^\w+\s+\d+ \d+:\d+:\d+\s+%(__prefix_line)sERROR:\s...
Use single line : Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-0...

Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [1] (?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?
`-

Lines: 1 lines, 0 ignored, 0 matched, 1 missed
[processed in 0.00 sec]

|- Missed line(s):
| Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error
`-

40 replies • 2019-03-26 12:04:45 +08:00

shenxgan

Mar 21, 2019

>>> re_s = '^\w+\s+\d+ \d+:\d+:\d+\s+(.*)ERROR:\s+failed to handshake with <HOST>: authentication error$'
>>> re.findall(re_s, s)
['<hostname> ss-server[1382]: 2018-08-15 08:59:07 ']
>>>

你的正则没有问题吧，我用 python 没问题

notgood

Mar 21, 2019

@shenxgan 我刚又试了你的也不能匹配, 真奇怪, 你说 python 没问题那正则表达式应该是正确的呀???
fail2ban-regex 'Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error' '^\w+\s+\d+ \d+:\d+:\d+\s+(.*)ERROR:\s+failed to handshake with <HOST>: authentication error$'

7654

Mar 21, 2019

https://jex.im/regulex/#!flags=&re=%5E%5Cw%2B%5Cs%2B%5Cd%2B%20%5Cd%2B%3A%5Cd%2B%3A%5Cd%2B%5Cs%2B%25(__prefix_line)sERROR%3A%5Cs%2B

antileech

Mar 21, 2019

排除法，先把头尾的^$摘了，看看行不行，不行再摘

或者像这样，反过来，从简单的写起来：
\d+:\d+:\d+\s+(.*)ERROR:

Varobjs

Mar 21, 2019 via Android

搜个正则表达式在线测试网站？

notgood

Mar 21, 2019

@7654 谢谢! 看了好久也没发现哪里异常啊, 您发现有什么不对的吗? 谢谢

notgood

Mar 21, 2019

@Varobjs 已经试了好几个测试网站 , 没有用
@antileech 您说的我试了, 还是不行, 简化后也是没有匹配

Varobjs

Mar 21, 2019 via Android

@notgood 正则在不同的语言，不同的地方使用的模式有差异的，比如之前遇到 grep 命令正则不支持\d，加个 -P 就支持了，建议看见你用的语言支持的是不是有区别

notgood

Mar 21, 2019

@antileech 试过了很多参数都不行 . 比如这个 fail2ban-regex 'Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with 95.179.169.185: authentication error' '^\s+ERROR:\s+failed to handshake with <HOST>: authentication error$'

@7654

antileech

Mar 21, 2019

@notgood 9# 这条不是从行开头开始匹配，得把^去掉，另外 ip 中的.看看有没有转义

0mza987

Mar 21, 2019

你 reg 里那个 ERROR 前面的小 s 是什么鬼，是\s 吧

0mza987

Mar 21, 2019

要匹配什么东西，在达到目的的情况下 reg 尽量精简，你那头尾一大堆根本就不需要的匹配，只是变成扰乱自己实现的无效代码而已

herozzm

Mar 22, 2019 via iPhone

我手头有份爬虫匹配兼职专门写正则的 lz 考虑拿来练手？

araraloren

Mar 22, 2019

不同语言的正则是有比较大的差别的，或许你可以了解一下 https://www.regular-expressions.info

JerryV2

Mar 22, 2019

__prefix_line 是什么，搜了半天也没看懂

wizardoz

Mar 22, 2019

正则表达式在不同的库里面支持规范是不一样的，就像不同的数据库支持的 SQL 也略有不同。
在 python 中测试了能匹配，只能说在 python 正则库中没问题

JerryV2

Mar 22, 2019

@JerryV2
仔细看了一下，是 Fail2ban 里的一个参数，是要匹配 <hostname> ss-server[1382]: 2018-08-15 08:59:07 这段吧？
没搞过，如果这块也没问题就不懂了

richieboy

Mar 22, 2019

这明显无法匹配啊,你括号不用转义吗?还是我理解的有问题?

versionzhang

Mar 22, 2019 via Android

@herozzm 功能复杂么，加个微信聊一下？ base64 wx：U2VyZW5hZGVMaWZl

ghostsimon

Mar 22, 2019

^\w+\s+\d+ \d+:\d+:\d+\s+(.+)\s+ERROR:\s+failed to handshake with <HOST>: authentication error$
https://regex101.com/
可以测试通过

ghostsimon

Mar 22, 2019

# coding=utf8
# the above tag defines encoding for this document and is for Python 2.x compatibility

import re

regex = r"^\w+\s+\d+ \d+:\d+:\d+\s+(.+)\s+ERROR:\s+failed to handshake with <HOST>: authentication error$"

test_str = "Aug 15 08:59:07 <hostname> ss-server[1382]: 2018-08-15 08:59:07 ERROR: failed to handshake with <HOST>: authentication error"

matches = re.finditer(regex, test_str, re.MULTILINE)

for matchNum, match in enumerate(matches, start=1):

print ("Match {matchNum} was found at {start}-{end}: {match}".format(matchNum = matchNum, start = match.start(), end = match.end(), match = match.group()))

for groupNum in range(0, len(match.groups())):
groupNum = groupNum + 1

print ("Group {groupNum} found at {start}-{end}: {group}".format(groupNum = groupNum, start = match.start(groupNum), end = match.end(groupNum), group = match.group(groupNum)))

# Note: for Python 2.7 compatibility, use ur"" to prefix the regex and u"" to prefix the test string and substitution.