fail2ban-regex LOG REGEX -d DATEPATTERN -v
Only works on xrdp version v0.9.18 or newer: https://github.com/neutrinolabs/xrdp/tree/v0.9.18.
Detects '[20230628-05:33:09] [INFO ] AUTHFAIL: user=testuser ip=192.168.0.2 time=1687930389' line from xrdp sesman log.