yeah -- and if switched to tuples here it would be ```match=match + (len(ret)>1,)```.  Although cumbersome for fail2ban-regex, might be advantageous in general.
probably I need to go to sleep but why here ```len(ret)>1``` and not ```>0```?