mirror of https://github.com/fail2ban/fail2ban
39 lines
2.2 KiB
Diff
39 lines
2.2 KiB
Diff
From: Yaroslav Halchenko <debian@onerussian.com>
|
|
Subject: ENH: adding custom date format for proftpd when logging in its own log file (default on Debian) -- includes milliseconds
|
|
Should resolve Debian #648276
|
|
|
|
--- a/server/datedetector.py
|
|
+++ b/server/datedetector.py
|
|
@@ -101,6 +101,13 @@ class DateDetector:
|
|
template.setRegex("\d{2}/\d{2}/\d{4}:\d{2}:\d{2}:\d{2}")
|
|
template.setPattern("%m/%d/%Y:%H:%M:%S")
|
|
self._appendTemplate(template)
|
|
+ # proftpd 2013-11-16 21:43:03,296
|
|
+ # So like Exim below but with ,subsecond
|
|
+ template = DateStrptime()
|
|
+ template.setName("Year-Month-Day Hour:Minute:Second[,subsecond]")
|
|
+ template.setRegex("\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d+")
|
|
+ template.setPattern("%Y-%m-%d %H:%M:%S,%f")
|
|
+ self._appendTemplate(template)
|
|
# Exim 2006-12-21 06:43:20
|
|
template = DateStrptime()
|
|
template.setName("Year-Month-Day Hour:Minute:Second")
|
|
--- a/testcases/datedetectortestcase.py
|
|
+++ b/testcases/datedetectortestcase.py
|
|
@@ -74,6 +74,7 @@ class DateDetectorTest(unittest.TestCase
|
|
(False, "23/Jan/2005:21:59:59"),
|
|
(False, "01/23/2005:21:59:59"),
|
|
(False, "2005-01-23 21:59:59"),
|
|
+ (False, "2005-01-23 21:59:59,099"), # proftpd
|
|
(False, "23-Jan-2005 21:59:59"),
|
|
(False, "23-01-2005 21:59:59"),
|
|
(False, "01-23-2005 21:59:59.252"), # reported on f2b, causes Feb29 fix to break
|
|
--- a/testcases/files/logs/proftpd
|
|
+++ b/testcases/files/logs/proftpd
|
|
@@ -14,3 +14,5 @@ Jun 14 00:09:59 platypus.ace-hosting.com
|
|
May 31 10:53:25 mail proftpd[15302]: xxxxxxxxxx (::ffff:1.2.3.4[::ffff:1.2.3.4]) - Maximum login attempts (3) exceeded
|
|
# failJSON: { "time": "2004-12-05T15:44:32", "match": true , "host": "1.2.3.4" }
|
|
Dec 5 15:44:32 serv1 proftpd[70944]: serv1.domain.com (example.com[1.2.3.4]) - USER jtittle@domain.org: no such user found from example.com [1.2.3.4] to 1.2.3.4:21
|
|
+# failJSON: { "time": "2013-11-16T21:59:30", "match": true , "host": "1.2.3.4", "desc": "proftpd-basic 1.3.5~rc3-2.1 on Debian uses date format with milliseconds if logging under /var/log/proftpd/proftpd.log" }
|
|
+2013-11-16 21:59:30,121 novo proftpd[25891] localhost (andy[1.2.3.4]): USER kjsad: no such user found from andy [1.2.3.5] to ::ffff:192.168.1.14:21
|