Primeiramente. Esta (talvez) não é uma resposta, mas talvez seja melhor do que um comentário (e um pouco longo para isso).
Carimbos de hora
Encontre sua declaração:
Actually, it can scan files without any time on any line and it will still work.
conflitando com a documentação. O que você quer dizer com trabalho ?
Os filtros manuais # (v 0.8) declaram :
If you're creating your own failregex expressions, here are some things you should know:
[...]
In order for a log line to match your failregex, it actually has to match in two parts: the beginning of the line has to match a timestamp pattern or regex, and the remainder of the line has to match your failregex. If the failregex is anchored with a leading ^, then the anchor refers to the start of the remainder of the line, after the timestamp and intervening whitespace.
The pattern or regex to match the time stamp is currently not documented, and not available for users to read or set. See Debian bug #491253. This is a problem if your log has a timestamp format that fail2ban doesn't expect, since it will then fail to match any lines. Because of this, you should test any new failregex against a sample log line, as in the examples below, to be sure that it will match. If fail2ban doesn't recognize your log timestamp, then you have two options: either reconfigure your daemon to log with a timestamp in a more common format, such as in the example log line above; or file a bug report asking to have your timestamp format included.
Note que os arquivos de log podem ser configurados para incluir os timestamps, bem como o formato dos timestamps. (Isso inclui dmesg como mencionado no comentário.)
Veja também este tópico, as Mensagens # 14 e # 19 em particular:
Dois exemplos:
Note que você também pode testar com comandos como:
fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
1 Sem carimbo de hora:
$ fail2ban-regex ' [1.2.3.4] authentication failed' '\[<HOST>\] authentication failed'
Running tests
=============
Use failregex line : \[<HOST>\] authentication failed
Use single line : [1.2.3.4] authentication failed
Results
=======
Failregex: 0 total
Ignoreregex: 0 total
Date template hits:
Lines: 1 lines, 0 ignored, 0 matched, 1 missed
|- Missed line(s):
| [1.2.3.4] authentication failed
'-
2 Com carimbo de data / hora:
$ fail2ban-regex 'Jul 18 12:13:01 [1.2.3.4] authentication failed' '\[<HOST>\] authentication failed'
Running tests
=============
Use failregex line : \[<HOST>\] authentication failed
Use single line : Jul 18 12:13:01 [1.2.3.4] authentication failed
Results
=======
Failregex: 1 total
|- #) [# of hits] regular expression
| 1) [1] \[<HOST>\] authentication failed
'-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [1] MONTH Day Hour:Minute:Second
'-
Lines: 1 lines, 0 ignored, 1 matched, 0 missed
Tempos de verificação
It is quite difficult to evaluate the reaction time. Fail2ban waits 1 second before checking for new logs to be scanned. This should be fine in most cases. However, it is possible to get more login failures than specified by maxretry.
A esse respeito, veja também este tópico: Re: Bug # 481265: fail2ban: Poll intervalo não é configurável .
Mas, no software opcional, mas recomendado , é possível encontrar o Gamin.
Gamin is a file alteration monitor. Gamin greatly benefits from a "inotify"-enabled kernel. Thus, active polling is no longer required to get the file modifications.
Se o Gamin estiver instalado e backend em jail.conf estiver definido como auto (ou gamin ) - será utilizado o Gamin.