From 76e5d2b1998265d33f7ae1b30bb72b02d0e1515f Mon Sep 17 00:00:00 2001 From: sebres Date: Fri, 21 Aug 2020 17:11:56 +0200 Subject: [PATCH] amend to f21c58dc7249fca1c35b50d5cd6d31bbb0fdcd42, better follow previous handling with last known datetime (compatibility for multi-line logs, in case of second line without a timestamp) --- fail2ban/server/filter.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py index d10da7ab..4e947d27 100644 --- a/fail2ban/server/filter.py +++ b/fail2ban/server/filter.py @@ -625,11 +625,14 @@ class Filter(JailThread): self.__lastDate = date else: logSys.error("findFailure failed to parse timeText: %s", m) + # matched empty value - date is optional or not available - set it to last known or now: + elif self.__lastDate and self.__lastDate > MyTime.time() - 60: + # set it to last known: + tupleLine = ("", self.__lastTimeText, line) + date = self.__lastDate else: - # matched empty value - date is optional or not available - set it to now: + # set it to now: date = MyTime.time() - self.__lastTimeText = "" - self.__lastDate = date else: tupleLine = ("", "", line) # still no date - try to use last known: