On Mon, Sep 21, 2020 at 12:34 PM Robert Kudyba <[email protected]> wrote:
> Sure but I'm still wondering if: > 2020-09-21 10:23:29,368 fail2ban.actions [621763]: WARNING [sshd] > 107.175.215.101 already banned > 2020-09-21 10:23:29,384 fail2ban.observer [621763]: INFO [sshd] > Found 107.175.215.101, bad - 2020-09-21 10:19:15, 1 # -> 2.0 > 2020-09-21 10:23:29,384 fail2ban.observer [621763]: INFO [sshd] > Found 107.175.215.101, bad - 2020-09-21 10:19:20, 1 # -> 2.0 > > How can the subsequent logs show up if the IP is already banned? > Others that know the inner workings of fail2ban may know better, but perhaps because the bans wern't actually working before (but they still get put in the sqlite database), you may see this for a while until all the old bans expire. But that's just a theory I have at the moment. Thanks, Richard
_______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
