Hi @globo

probably you should use something like the following:

failregex = ^.*Login failed.*Remote IP:.<HOST>..*$

Hi theMiddle, thanks for your quick response
But always trouble after I have changed owncloud.conf in filter.d,

Running tests

Use failregex filter file : owncloud, basedir: /etc/fail2ban
Use log file : /var/log/clients/OWNCLOUD1.xxx-xxx-xxx.com/syslog.log
Use encoding : UTF-8

Results

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [341] (?:DAY )?MON Day 24hour:Minute:Second(?:.Microseconds)?(?: Year)?
`-

Lines: 341 lines, 0 ignored, 0 matched, 341 missed [processed in 0.02 sec]

but i verify in the log file,
Mar 1 08:42:23 OWNCLOUD1 ownCloud[34887]: {core} Login failed: ‘essai’ (Remote IP: 'xxx.xxx.xxx.xxx’)

Ok I find the correct regex
failregex = .: {core} Login failed: ’.’ (Remote IP: ’<HOST>’)