You can't mend it really. It is an annoying message. I sent an question to the fail2ban mailinglist yesterday, and I am awaiting a reply.
I ought to uninstall fail2ban, and re-install all the jails. It might just be a question of deleting these two jails and put them back later. It is really annoying > On 24 Feb 2022, at 7:02 pm, Graham B. <fail2...@chuckerytowers.plus.com> > wrote: > > On Wed, 23 Feb 2022, Sophie Loewenthal wrote: > >> Date: Wed, 23 Feb 2022 09:13:06 >> From: Sophie Loewenthal <sop...@klunky.co.uk> >> To: fail2ban-users@lists.sourceforge.net >> Subject: [Fail2ban-users] Warning message: Please check jail has possibly a >> timezone issue. Line with odd timestamp: >> Hi, >> >> I had this message from fail2ban after an upgrade from Debian 9 to 10 for >> many months. >> >> fail2ban 0.11.2-2 >> >> How could I mend these jails? >> >> ** WARNINGS ** >> [nginx-x1] Please check jail has possibly a timezone issue. Line with odd >> timestamp: 35.205.35.197 - - [01/Feb/2022:03:10:28 +0000] "GET / HTTP/1.1" >> 200 12778 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 >> (KHTML, like Gecko) Chrome/1.1.1.1/Safari/537.36": 1 Time(s) >> [nginx-x1] Simulate NOW in operation since found time has too large >> deviation 1645415788 ~ 1645488002.6590989 +/- 60: 1 Time(s) >> >> I think that the programme thinks that the time is an IP address. Perhaps... >> :-) >> >> Regards, >> So >> >> _______________________________________________ >> Fail2ban-users mailing list >> Fail2ban-users@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/fail2ban-users >> > > Hello So, > > My first thought was a regular expression that was too generous in > matching ".", but I cannot see that fitting here. > > Next, I looked at converting the I.P. address from "dotted quad" into > decimal (using "bc"), but that did not obviously match ... > > (((35*256 + 205) * 256) + 35 * 256) + 197 > 2355397 > > ... or with more parentheses and spaces ... > > (((((35 * 256) + 205) * 256) + 35) * 256) + 197 > 600646597 > > ... then at the differences in times ... > > 1645415788 - 1645488002.6590989 > -72214.6590989 > quit > > I am sorry that I have not found a helpful answer for you, but I hope that > you can find a solution. Perhaps if we had more sample log entries, we might > learn more. > > Yours, > -- > Graham > > > <a href="http://english-1329209197.spampoison.com";>Get free spam bait > here.</a> > _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
