On Wed, 23 Feb 2022, Sophie Loewenthal wrote:
Date: Wed, 23 Feb 2022 09:13:06
From: Sophie Loewenthal <sop...@klunky.co.uk>
To: fail2ban-users@lists.sourceforge.net
Subject: [Fail2ban-users] Warning message: Please check jail has possibly a
timezone issue. Line with odd timestamp:
Hi,
I had this message from fail2ban after an upgrade from Debian 9 to 10 for many
months.
fail2ban 0.11.2-2
How could I mend these jails?
** WARNINGS **
[nginx-x1] Please check jail has possibly a timezone issue. Line with odd timestamp: 35.205.35.197 - -
[01/Feb/2022:03:10:28 +0000] "GET / HTTP/1.1" 200 12778 "-" "Mozilla/5.0 (Windows NT
10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.1.1.1/Safari/537.36": 1 Time(s)
[nginx-x1] Simulate NOW in operation since found time has too large deviation
1645415788 ~ 1645488002.6590989 +/- 60: 1 Time(s)
I think that the programme thinks that the time is an IP address. Perhaps... :-)
Regards,
So
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
Hello So,
My first thought was a regular expression that was too generous in matching
".", but I cannot see that fitting here.
Next, I looked at converting the I.P. address from "dotted quad" into decimal
(using "bc"), but that did not obviously match ...
(((35*256 + 205) * 256) + 35 * 256) + 197
2355397
... or with more parentheses and spaces ...
(((((35 * 256) + 205) * 256) + 35) * 256) + 197
600646597
... then at the differences in times ...
1645415788 - 1645488002.6590989
-72214.6590989
quit
I am sorry that I have not found a helpful answer for you, but I hope
that you can find a solution. Perhaps if we had more sample log entries, we
might learn more.
Yours,
--
Graham
<a href="http://english-1329209197.spampoison.com";>Get free spam bait here.</a>
_______________________________________________
Fail2ban-users mailing list
Fail2ban-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
