regex to exclude a specific pattern

admin

ACCEPT when both have failures > x times

when I only have pam_unix(sudo:auth) failures > x times

when I only have pam_sss(sudo:auth) failures > x times

REJECT when:

I have 1 pam_unix failure followed by 1 pam_sss success

Aug 20 15:11:58 web-04 sudo: pam_unix(sudo:auth): authentication failure;
Aug 20 15:11:58 web-04 sudo: pam_sss(sudo:auth): authentication success;

I would want to reject the pattern when failure is immediately followed by success but accept the pattern when it is just failure and not followed by success. is it possible through regex?

Read more here: Source link