[Definition]
# Matches Nginx combined log format:
# 1.2.3.4 - - [18/Mar/2026:09:45:00 +0000] "GET /path HTTP/1.1" 404 162 "-" "agent"
#
# Triggers on 4xx responses (config probes, scanners, bad requests)
# 5xx excluded to avoid banning on legitimate server errors

failregex = ^<HOST> - \S+ \[.*?\] "(?:GET|POST|HEAD|PUT|DELETE|OPTIONS|PATCH) \S+ HTTP/\d\.\d" 4\d\d \d+

ignoreregex = ^<HOST> - \S+ \[.*?\] "\S+ \S+ HTTP/\d\.\d" 400 \d+.*"NTRIP