Regular Expressions 101

^start of string

Group 1(\S+|\S+\s+\d+\s+\S+)

1st Alternative\S+

\S+any non-whitespace character, repeated at least once

2nd Alternative\S+\s+\d+\s+\S+

\S+any non-whitespace character, repeated at least once

\s+any whitespace character, repeated at least once

\d+a digit, repeated at least once

\s+any whitespace character, repeated at least once

\S+any non-whitespace character, repeated at least once

the literal (32₁₀ / 40₈ / 20₁₆)

Group 2(\S+ )?

?repeats the group contents below at most once:

\S+any non-whitespace character, repeated at least once

the literal (32₁₀ / 40₈ / 20₁₆)

sshdthe literal text sshd (case sensitive)

\[the literal [ (91₁₀ / 133₈ / 5B₁₆)

\d+a digit, repeated at least once

\]the literal ] (93₁₀ / 135₈ / 5D₁₆)

: Failed password for the literal text : Failed password for (case sensitive)

Group 3(invalid user |illegal user )?

?repeats the group contents below at most once:

1st Alternativeinvalid user

invalid user the literal text invalid user (case sensitive)

2nd Alternativeillegal user

illegal user the literal text illegal user (case sensitive)

Group 4(\S*)

\S*any non-whitespace character, repeated any number of times

from the literal text from (case sensitive)

Group 5(\S+)

\S+any non-whitespace character, repeated at least once

Group 6( port \S+ \S+\s*)?

?repeats the group contents below at most once:

port the literal text port (case sensitive)

\S+any non-whitespace character, repeated at least once

the literal (32₁₀ / 40₈ / 20₁₆)

\S+any non-whitespace character, repeated at least once

\s*any whitespace character, repeated any number of times

Detailed match information will be displayed here automatically.

Search reference

Regular Expression

^(\S+|\S+\s+\d+\s+\S+) (\S+ )?sshd\[\d+\]: Failed password for (invalid user |illegal user )?(\S*) from (\S+)( port \S+ \S+\s*)?

New

May 23 16:57:33 nostalgia-for-infinity sshd[8541]: Failed password for invalid user root from 8.8.8.8 port 123 ssh2 from 127.0.0.1 port 50594 ssh2