On 10/1/18 12:10 AM, Nick Howitt wrote: > It is all to do with the sequence of events on your box and which > element f2b is trying to detect. > In that case I would expect a single entry for a given IP address. There are many such entries.
Recent examples below. For each example there is an entry in iptables that is supposed to block it, and an entry in the mail proxy log that has received a connection for an allegedly blocked IP. 2018-10-01 09:00:52,931 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 09:13:48,002 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 09:26:30,874 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 09:39:36,412 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 09:52:58,544 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 10:05:44,009 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 10:18:37,674 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 10:31:29,239 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 10:44:12,873 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 10:57:03,544 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned 2018-10-01 11:09:55,832 fail2ban.actions [16451]: WARNING [assp] 185.36.81.145 already banned -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think. _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
