fail2ban.server.datedetector module

class fail2ban.server.datedetector.DateDetector

Bases: object

Manages one or more date templates to find a date within a log line.

Attributes:
templates

List of template instances managed by the detector.

Methods

addDefaultTemplate([filterTemplate, ...])

Add Fail2Ban's default set of date templates.

appendTemplate(template)

Add a date template to manage and use in search of dates.

getTime(line[, timeMatch])

Attempts to return the date on a log line using templates.

matchTime(line)

Attempts to find date on a log line using templates.

addDefaultTemplate(filterTemplate=None, preMatch=None, allDefaults=True)

Add Fail2Ban’s default set of date templates.

appendTemplate(template)

Add a date template to manage and use in search of dates.

Parameters:
templateDateTemplate or str

Can be either a DateTemplate instance, or a string which will be used as the pattern for the DatePatternRegex template. The template will then be added to the detector.

Raises:
ValueError

If a template already exists with the same name.

property default_tz
getTime(line, timeMatch=None)

Attempts to return the date on a log line using templates.

This uses the templates’ getDate method in an attempt to find a date. For the faster usage, always specify a parameter timeMatch (the previous tuple result of the matchTime), then this will work without locking and without cycle over templates.

Parameters:
linestr

Line which is searched by the date templates.

Returns:
float

The Unix timestamp returned from the first successfully matched template or None if not found.

matchTime(line)

Attempts to find date on a log line using templates.

This uses the templates’ matchDate method in an attempt to find a date. It also increments the match hit count for the winning template.

Parameters:
linestr

Line which is searched by the date templates.

Returns:
re.MatchObject, DateTemplate

The regex match returned from the first successfully matched template.

property templates

List of template instances managed by the detector.

class fail2ban.server.datedetector.DateDetectorCache

Bases: object

Implements the caching of the default templates list.

Attributes:
defaultTemplates
templates

List of template instances managed by the detector.

DEFAULT_TEMPLATES = ['%ExY(?P<_sep>[-/.])%m(?P=_sep)%d(?:T|  ?)%H:%M:%S(?:[.,]%f)?(?:\\s*%z)?', '(?:%a )?%b %d %k:%M:%S(?:\\.%f)?(?: %ExY)?', '(?:%a )?%b %d %ExY %k:%M:%S(?:\\.%f)?', '%d(?P<_sep>[-/])%m(?P=_sep)(?:%ExY|%Exy) %k:%M:%S', '%d(?P<_sep>[-/])%b(?P=_sep)%ExY[ :]?%H:%M:%S(?:\\.%f)?(?: %z)?', '%m/%d/%ExY:%H:%M:%S', '%m-%d-%ExY %k:%M:%S(?:\\.%f)?', 'EPOCH', '{^LN-BEG}%H:%M:%S', '^<%m/%d/%Exy@%H:%M:%S>', '%Exy%Exm%Exd  ?%H:%M:%S', '%b %d, %ExY %I:%M:%S %p', '^%b-%d-%Exy %k:%M:%S', '%ExY%Exm%Exd(?:T|  ?)%ExH%ExM%ExS(?:[.,]%f)?(?:\\s*%z)?', '(?:%Z )?(?:%a )?%b %d %k:%M:%S(?:\\.%f)?(?: %ExY)?', '(?:%z )?(?:%a )?%b %d %k:%M:%S(?:\\.%f)?(?: %ExY)?', 'TAI64N']
property defaultTemplates
property templates

List of template instances managed by the detector.

class fail2ban.server.datedetector.DateDetectorTemplate(template)

Bases: object

Used for “shallow copy” of the template object.

Prevents collectively usage of hits/lastUsed in cached templates

Attributes:
distance
hits
lastUsed
template
weight
distance
hits
lastUsed
template
property weight