Question

Are there any tools out there that will build a generic regular expression for me if it’s given a specific string as input?

At the moment I”ll settle for an actual regex instead of a tool.

Note that in my case I can use HOST in angle brackets to represent the IP address in the regex. My goal is to build a regex for the tool called “fail2ban”.

Lets say my string is
[2012-11-06 22:52:40] NOTICE[4339] chan_sip.c: Registration from ‘”202″‘ failed for ‘111.111.11.1:9546’ – Wrong password

(It looks like this forum is apparently stripping out symbols and/or otherwise messing with my string so I’ll use the following conventions so you can see what it’s supposed to say:
DQ to represent a DOUBLE QUOTE ”
LAB to represent a LEFT ANGLE BRACKET <
RAB to represent a RIGHT ANGLE BRACKET >
AT to represent an at sign @
)

Using the above conventions:

[2012-11-06 22:52:40] NOTICE[4339] chan_sip.c: Registration from ‘DQ 202 DQ LAB sip:202 AT emailAddress RAB’ failed for ‘111.111.11.1:9546’ – Wrong password

Note that I have added spaces between symbols to increase readability. They are not part of the original string.

I have tried NOTICE.* .: Registration from ‘.‘ failed for ‘:.*’ – Wrong password

and:
NOTICE.* .: Registration from ‘\”.\”‘ failed for ‘:.*’ – Wrong password

What is the proper regex please?

Thank you in advance

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sidenote: If none already exist, it sure would be nice if someone could build a tool to automate building a regular expression given a particular string.

Here’s what I’m thinking.

The string could be easily parsed by the following C library functions isalphanum(c), isalpha(c), isdigit(c), ispunct(c), isspace(c).

The hard part is building a regular expression generator.

Answer 1

Try

NOTICE.+: Registration from '.+' failed for '.+' - Wrong password

The tool I used to flesh that out was RegExr.

EDIT:

I Googled for “regex generator” and came across this result. That is probably what you are looking for (self: adds link to bookmarks)