I have the following filter rule in

/etc/fail2ban/filter.d/zenphoto.local

    [Definition]
    failregex = \w{24}.*Fehlgeschlagen
    datepattern = %%Y-%%m-%%d\ %%H:%%M:%%S
    #ignoreregex =

And a typical entry in my logpath

/var/www/zenphoto/zp-data/security.log

    2022-12-12 20:04:06     192.168.100.1   Administrations-Anmeldung       zenadmin2               Fehlgeschlagen

but the regex does not apply. Dont know why it does not work.

Maybe someone has an up and running fail2ban configuration with the zenphoto log ?

at least the fail2ban-regex works now with
/etc/fail2ban/filter.d/zenphoto.local

[Definition]
failregex = .*.*Fehlgeschlagen
datepattern = "%%Y-%%m-%%d\ %%H:%%M:%%S"
ignoreregex =

it just does not set the IP to blocking mode, needs further investigation..

Sorry, I cannot help, I don't even know what fail2ban is…