Regex help?

Having some difficulty getting this to work for successfulloginregex

      <LogFile>

        <Source>FTP</Source>
        <PathAndMask>C:/Program Files/FileZilla Server/Logs/filezilla-server.log</PathAndMask>
        <FailedLoginRegex>
          <![CDATA[
            (?<timestamp>\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d).+<<\s\[FTP\sSession\s.*\s(?<ipaddress>.+)]\s530\sLogin\sincorrect
          ]]>
        </FailedLoginRegex>
        <SuccessfulLoginRegex>
          <![CDATA[
            (?<timestamp>\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\d).*\s(?<ipaddress>.+)\s(?<username>.+)]\s230
          ]]>
        </SuccessfulLoginRegex>
        <PlatformRegex>Windows</PlatformRegex>
        <PingInterval>10000</PingInterval>
        <MaxFileSize>0</MaxFileSize>
        <FailedLoginThreshold>0</FailedLoginThreshold>

      </LogFile>

I get this in logs

2022-04-17 00:08:57.1527|INFO|DigitalRuby.IPBanCore.Logger|Parsing as IP failed, checking dns '2022-04-17T04:08:49.329Z >> [FTP Session 39 123.123.123.123] PASS ****'
2022-04-17 00:08:57.1527|INFO|DigitalRuby.IPBanCore.Logger|Parsing as dns failed '2022-04-17T04:08:49.329Z >> [FTP Session 39 123.123.123.123] PASS ****'

2022-04-17T03:31:41.170Z << [FTP Session 38 123.123.123.123] 331 Please, specify the password.
2022-04-17T03:31:41.220Z >> [FTP Session 38 123.123.123.123] PASS ****
2022-04-17T03:31:41.283Z << [FTP Session 38 123.123.123.123 username] 230 Login successful.

Regex101 has highlighted the issue for me, it seems the regex engine used here is matching previous lines and not just single lines… how do I rectify this? I had to add more to the ‘failedloginregex’ to get this issue to go away, but I cannot seem to do anything to resolve this with successfulloginregex, any input is much appreciated

[jjxtra]

I updated the recipe

[kimboslice99]

@jjxtra Not sure if I should open a new issue, but how can I exclude IIS from event 4625 failed logins?

I have some sites with basic auth on IIS, but I’m using cloudflare’s proxy which uses CF-Connecting-IP header to log the real client IP address… I’ve tried changing the inbound header in IIS (url rewrite) like so

<set name="HTTP_X_REAL_IP" value="{HTTP_CF_CONNCTING_IP}" />

I’ve also tried X-Forwarded-For and X-Client-IP, but this doesn’t seem to work here, I suppose whats being logged in the event logger is before the URL rewrite can get to it, so I’d like to exclude IIS so I can use the log instead

Edit; would this be the right way to exclude IIS?

[^c:\\Windows\\System32\\inetsrv\\w3wp.exe]