Repository: fail2ban/fail2ban

Issue:
strptime.py Unhandled Exception after computer restart
### Environment:
- Fail2Ban version (including any possible distribution suffixes): Fail2Ban v0.10.0a2
- OS, including release name/version: OSX 10.11.6
- [x] Fail2Ban installed via OS/distribution mechanisms
- [x] You have not applied any additional foreign patches to the codebase
- [ ] Some customizations were done to the configuration (provide details below is so)
  (no customisations for fail2ban.conf)
### The issue:

strptime.py file  raises 'ValueError: year is out of range'  after each computer restart
#### Steps to reproduce
#### Expected behavior
#### Observed behavior
#### Any additional information

built with `sudo /usr/bin/python setup.py install`
### Configuration, dump and another helpful excerpts

```
fail2ban-client -d 
['set', 'syslogsocket', 'auto']
['set', 'loglevel', 'INFO']
['set', 'logtarget', '/var/log/fail2ban.log']
['set', 'dbfile', '/var/lib/fail2ban/fail2ban.sqlite3']
['set', 'dbpurgeage', '1d']
['add', 'short-ban', 'auto']
['set', 'short-ban', 'usedns', 'warn']
['set', 'short-ban', 'addlogpath', '/var/log/system.log', 'head']
['set', 'short-ban', 'maxretry', 3]
['set', 'short-ban', 'addignoreip', '127.0.0.1']
['set', 'short-ban', 'addignoreip', '192.168.100.0/24']
['set', 'short-ban', 'addignoreip', 'xxx.xxx.xxx.xxx']
['set', 'short-ban', 'logencoding', 'utf-8']
['set', 'short-ban', 'bantime', '600']
['set', 'short-ban', 'ignorecommand', '']
['set', 'short-ban', 'findtime', '7200']
['set', 'short-ban', 'maxlines', '10']
['multi-set', 'short-ban', 'addfailregex', ['^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?(?:error: PAM: )?[aA]uthentication (?:failure|error|failed) for .* from <HOST>( via \\S+)?\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?Failed \\S+ for .*? from <HOST>(?: port \\d*)?(?: ssh\\d*)?(: (ruser .*|(\\S+ ID \\S+ \\(serial \\d+\\) CA )?\\S+ (?:[\\da-f]{2}:){15}[\\da-f]{2}(, client user ".*", client host ".*")?))?\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?ROOT LOGIN REFUSED.* FROM <HOST>\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?[iI](?:llegal|nvalid) user .* from <HOST>\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?User .+ from <HOST> not allowed because not listed in AllowUsers\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?User .+ from <HOST> not allowed because listed in DenyUsers\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?User .+ from <HOST> not allowed because not in any group\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?refused connect from \\S+ \\(<HOST>\\)\\s*$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?(?:error: )?Received disconnect from <HOST>: 3: .*: Auth fail(?: \\[preauth\\])?$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?User .+ from <HOST> not allowed because a group is listed in DenyGroups\\s*$', "^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?User .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\\s*$", '^(?P<__prefix>(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \\[preauth\\]$', '^(?P<__prefix>(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?)Disconnecting: Too many authentication failures for .+? \\[preauth\\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \\[preauth\\]$', '^(?P<__prefix>(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?)Connection from <HOST> port \\d+(?: on \\S+ port \\d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \\[preauth\\]$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?(error: )?maximum authentication attempts exceeded for .* from <HOST>(?: port \\d*)?(?: ssh\\d*)? \\[preauth\\]$', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?sshd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?pam_unix\\(sshd:auth\\):\\s+authentication failure;\\s*logname=\\S*\\s*uid=\\d*\\s*euid=\\d*\\s*tty=\\S*\\s*ruser=\\S*\\s*rhost=<HOST>\\s.*$']]
['set', 'short-ban', 'addjournalmatch', '_SYSTEMD_UNIT=sshd.service', '+', '_COMM=sshd']
['set', 'short-ban', 'addaction', 'pf']
['multi-set', 'short-ban', 'action', 'pf', [['actionstop', 'pfctl -sr 2>/dev/null | grep -v <tablename> | pfctl -f-\npfctl -t <tablename> -T flush\npfctl -t <tablename> -T kill'], ['actioncheck', ''], ['actionban', '/sbin/pfctl -t <tablename> -T add <ip>'], ['actionstart', 'pfctl -d\npfctl -f /etc/pf.conf\npfctl -e'], ['actionunban', '/sbin/pfctl -t <tablename> -T delete <ip>'], ['protocol', 'tcp'], ['known/multiport', 'any port <port>'], ['known/actiontype', '<multiport>'], ['known/allports', 'any'], ['known/protocol', 'tcp'], ['multiport', 'any port <port>'], ['tablename', 'short'], ['known/tablename', 'short'], ['actiontype', '<multiport>'], ['allports', 'any']]]
['add', 'long-ban', 'auto']
['set', 'long-ban', 'usedns', 'warn']
['set', 'long-ban', 'addlogpath', '/var/log/fail2ban.log', 'head']
['set', 'long-ban', 'maxretry', 3]
['set', 'long-ban', 'addignoreip', '127.0.0.1']
['set', 'long-ban', 'addignoreip', '192.168.100.0/24']
['set', 'long-ban', 'addignoreip', 'XXX.XXX.XXX.XXX']
['set', 'long-ban', 'logencoding', 'utf-8']
['set', 'long-ban', 'bantime', '259200']
['set', 'long-ban', 'ignorecommand', '']
['set', 'long-ban', 'findtime', '604800']
['set', 'long-ban', 'addfailregex', 'NOTICE\\s+\\[short-ban\\]\\s+Ban\\s+<HOST>']
['set', 'long-ban', 'addignoreregex', 'NOTICE\\s+\\[long-ban\\]\\s+Ban\\s+<HOST>']
['set', 'long-ban', 'addaction', 'longban']
['multi-set', 'long-ban', 'action', 'longban', [['actionstop', 'pfctl -sr 2>/dev/null | grep -v <tablename> | pfctl -f-\npfctl -t <tablename> -T flush\npfctl -t <tablename> -T kill'], ['actioncheck', ''], ['actionban', '/sbin/pfctl -t <tablename> -T add <ip>'], ['actionstart', ''], ['actionunban', '/sbin/pfctl -t <tablename> -T delete <ip>'], ['protocol', 'tcp'], ['known/multiport', 'any port <port>'], ['known/actiontype', '<multiport>'], ['known/allports', 'any'], ['known/protocol', 'tcp'], ['multiport', 'any port <port>'], ['tablename', 'long'], ['known/tablename', 'long'], ['actiontype', '<multiport>'], ['allports', 'any']]]
['add', 'forever-ban', 'auto']
['set', 'forever-ban', 'usedns', 'warn']
['set', 'forever-ban', 'addlogpath', '/var/log/fail2ban.log', 'head']
['set', 'forever-ban', 'maxretry', 5]
['set', 'forever-ban', 'addignoreip', '127.0.0.1']
['set', 'forever-ban', 'addignoreip', '192.168.100.0/24']
['set', 'forever-ban', 'addignoreip', 'xxx.xx.xxx.xxx']
['set', 'forever-ban', 'logencoding', 'utf-8']
['set', 'forever-ban', 'bantime', '-1']
['set', 'forever-ban', 'ignorecommand', '']
['set', 'forever-ban', 'findtime', '604800']
['set', 'forever-ban', 'addfailregex', 'NOTICE\\s+\\[long-ban\\]\\s+Ban\\s+<HOST>']
['set', 'forever-ban', 'addignoreregex', 'NOTICE\\s+\\[forever\\]\\s+Ban\\s+<HOST>']
['set', 'forever-ban', 'addaction', 'forever']
['multi-set', 'forever-ban', 'action', 'forever', [['actionstop', ''], ['actioncheck', ''], ['actionban', '/sbin/pfctl -t forever -T add <ip>'], ['actionstart', ''], ['actionunban', ''], ['known/tablename', 'forever'], ['tablename', 'forever']]]
['add', 'vnc', 'auto']
['set', 'vnc', 'usedns', 'warn']
['set', 'vnc', 'addlogpath', '/var/log/system.log', 'head']
['set', 'vnc', 'maxretry', 3]
['set', 'vnc', 'addignoreip', '127.0.0.1']
['set', 'vnc', 'addignoreip', '192.168.100.0/24']
['set', 'vnc', 'addignoreip', '212.45.6.242']
['set', 'vnc', 'logencoding', 'utf-8']
['set', 'vnc', 'bantime', '600']
['set', 'vnc', 'ignorecommand', '']
['set', 'vnc', 'findtime', '3600']
['set', 'vnc', 'addfailregex', '.*: Authentication: FAILED :: User Name: .* :: Viewer Address: <HOST> :: Type: .*$']
['set', 'vnc', 'addaction', 'pf']
['multi-set', 'vnc', 'action', 'pf', [['actionstop', 'pfctl -sr 2>/dev/null | grep -v <tablename> | pfctl -f-\npfctl -t <tablename> -T flush\npfctl -t <tablename> -T kill'], ['actioncheck', ''], ['actionban', '/sbin/pfctl -t <tablename> -T add <ip>'], ['actionstart', 'pfctl -d\npfctl -f /etc/pf.conf\npfctl -e'], ['actionunban', '/sbin/pfctl -t <tablename> -T delete <ip>'], ['protocol', 'tcp'], ['known/multiport', 'any port <port>'], ['known/actiontype', '<multiport>'], ['known/allports', 'any'], ['known/protocol', 'tcp'], ['multiport', 'any port <port>'], ['tablename', 'short'], ['known/tablename', 'short'], ['actiontype', '<multiport>'], ['allports', 'any']]]
['start', 'short-ban']
['start', 'long-ban']
['start', 'forever-ban']
['start', 'vnc']
```
#### Any customizations done to /etc/fail2ban/ configuration

only added couple of  jails for incremental ban based on fail2ban.log parsing
#### Relevant parts of /var/log/fail2ban.log file:

_preferably obtained while running fail2ban with `loglevel = 4`_

I'm unable to provide DEGUG level log, because fail2ban.filterpoll spams fail2ban.log with 
`DEBUG   /var/log/fail2ban.log has been modified` message constantly (bug?)

```
2016-08-28 13:52:17,615 fail2ban                [251]: CRITICAL Unhandled exception in Fail2Ban:
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/fail2ban/server/jailthread.py", line 69, in run_with_except_hook
    run(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filterpoll.py", line 111, in run
    self.getFailures(filename)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 749, in getFailures
    self.processLineAndAdd(line)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 417, in processLineAndAdd
    for element in self.processLine(line, date)[1]:
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 412, in processLine
    tupleLine, date, returnRawHost, checkAllRegex)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 481, in findFailure
    dateTimeMatch = self.dateDetector.getTime(timeText, tupleLine[3])
  File "/Library/Python/2.7/site-packages/fail2ban/server/datedetector.py", line 227, in getTime
    date = template.getDate(line, timeMatch[0])
  File "/Library/Python/2.7/site-packages/fail2ban/server/datetemplate.py", line 247, in getDate
    return reGroupDictStrptime(groupdict), dateMatch
  File "/Library/Python/2.7/site-packages/fail2ban/server/strptime.py", line 178, in reGroupDictStrptime
    year, month, day, hour, minute, second, fraction)
ValueError: year is out of range
2016-08-28 13:52:17,641 fail2ban                [251]: CRITICAL Unhandled exception in Fail2Ban:
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/fail2ban/server/jailthread.py", line 69, in run_with_except_hook
    run(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filterpoll.py", line 111, in run
    self.getFailures(filename)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 749, in getFailures
    self.processLineAndAdd(line)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 417, in processLineAndAdd
    for element in self.processLine(line, date)[1]:
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 412, in processLine
    tupleLine, date, returnRawHost, checkAllRegex)
  File "/Library/Python/2.7/site-packages/fail2ban/server/filter.py", line 481, in findFailure
    dateTimeMatch = self.dateDetector.getTime(timeText, tupleLine[3])
  File "/Library/Python/2.7/site-packages/fail2ban/server/datedetector.py", line 227, in getTime
    date = template.getDate(line, timeMatch[0])
  File "/Library/Python/2.7/site-packages/fail2ban/server/datetemplate.py", line 247, in getDate
    return reGroupDictStrptime(groupdict), dateMatch
  File "/Library/Python/2.7/site-packages/fail2ban/server/strptime.py", line 178, in reGroupDictStrptime
    year, month, day, hour, minute, second, fraction)
ValueError: year is out of range
```
#### Relevant lines from monitored log files in question:

```
```



Discussion:
> I'm unable to provide DEGUG level log, because fail2ban.filterpoll spams fail2ban.log with
> DEBUG /var/log/fail2ban.log has been modified message constantly (bug?)

No not a bug, you can not use DEBUG as long as you parse f2b.log, because then your "recidive" jails will always find modifications, because they are write it self.
To test in DEBUG mode, just disable this jails...

To the issue: I suspect it could be some "strange" date-time pattern, where something will be found as year. Can you check the newest fix #1512 included in your installation?
Otherwise try it with DEBUG without recidive jails

Hi!
I disabled incremental jails but nothing appeared in log, just the same ValueError on launch. 
Only if I disable all jails, the error will not be shown.
Strangely, it only appears on computer launch. If I restart fail2ban-client a bit later, it launches without error and works well.
I checked #1512 - it seems like I have the same build installed (datetemplate.py file has the same changes)

Thx,
well, the fix does the check of word boundaries, but it can be still the wrong recognition of date time, so the large number like 9999 will be recognized as year... 
You can currently only direct specify the date pattern for the jails, that really used in the log format. I'll make two things as new PR:
- log the value and the pattern, to know which it is
- move this pattern in the error case to bottom of template list and repeat auto recognition of date template (any case better as boom)

Can you look in your logs, where it should after start find the large or too small number implicit before date in some format without year?

> just the same ValueError on launch. 

Have you tried debug mode? Any messages explicit before boom?

it might be worth just running the server under pdb (python debugger) and intospect from the point of failure what is happening.  smth like (didn't try)

in one shell

``` shell

pdb `which fail2ban-server` -f --loglevel INFO --logtarget=STDOUT -v
```

and if we are in luck and it stops at the exception -- go up and see on which line it failed etc

No messages in DEBUG mode except this one:

```
2016-08-28 20:37:05,368 fail2ban.filterpoll     [240]: DEBUG   /var/log/system.log has been modified
2126 2016-08-28 20:37:06,705 fail2ban                [240]: CRITICAL Unhandled exception in Fail2Ban:
2127 Traceback (most recent call last): ...
```

By the way. I think you're right about wrong date. Before upgrade to v0.10 (which in fact suits me much more than 0.9) I saw this error message on launch (found in old log)

`2016-08-16 10:01:15,896 fail2ban.filter         [258]: ERROR   findFailure failed to parse timeText: 0000-12-30 00:0       0:00`
But in v0.9 this error never crashed fail2ban. 

Thx, that helps a bit... I'll try to find and fix it.

Hi! I've found that piece in system.log that caused this error:

```
 Aug 28 20:37:04 server Keychain Circle Notification[402]: writeToStorage plist={
             absentCircleWithNoReason = 0;
             applicationDate = "0000-12-30 00:00:00 +0000";
             lastCircleStatus = "-1";
             lastWritten = "2016-08-28 17:37:04 +0000";
             pendingApplicationReminder = "4001-01-01 00:00:00 +0000";
             pendingApplicationReminderInterval = 172800;
}
```

This "Keychain Circle Notification" is some strange piece of opensource software in OSX, which is responsible for handling iCloud Keychain Approval. And I'm not sure if I can safely disable it or delete :(  iCloud is not even enabled on my server. 

really so with newlines? I though, the newlines will be escaped as `\n` in message if someone writes it in syslog... weird.

I copied this from vim. 
That's how it looks like: 
![f2ban_error](https://cloud.githubusercontent.com/assets/11698866/18081995/8938c9e6-6ea5-11e6-965b-c882ef7ad4d6.JPG)

Very very evil... (I mean the newlines)


Resolving patch:
diff --git a/fail2ban/server/datedetector.py b/fail2ban/server/datedetector.py
--- a/fail2ban/server/datedetector.py
+++ b/fail2ban/server/datedetector.py
@@ -224,12 +224,15 @@ def getTime(self, line, timeMatch=None):
 		if timeMatch:
 			template = timeMatch[1]
 			if template is not None:
-				date = template.getDate(line, timeMatch[0])
-				if date is not None:
-					if logSys.getEffectiveLevel() <= logLevel:
-						logSys.log(logLevel, "Got time %f for \"%r\" using template %s",
-							date[0], date[1].group(), template.name)
-					return date
+				try:
+					date = template.getDate(line, timeMatch[0])
+					if date is not None:
+						if logSys.getEffectiveLevel() <= logLevel:
+							logSys.log(logLevel, "Got time %f for %r using template %s",
+								date[0], date[1].group(), template.name)
+						return date
+				except ValueError:
+					return None
 		with self.__lock:
 			for template in self.__templates:
 				try:
@@ -237,7 +240,7 @@ def getTime(self, line, timeMatch=None):
 					if date is None:
 						continue
 					if logSys.getEffectiveLevel() <= logLevel:
-						logSys.log(logLevel, "Got time %f for \"%r\" using template %s", 
+						logSys.log(logLevel, "Got time %f for %r using template %s", 
 							date[0], date[1].group(), template.name)
 					return date
 				except ValueError: # pragma: no cover
diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py
--- a/fail2ban/server/filter.py
+++ b/fail2ban/server/filter.py
@@ -29,6 +29,7 @@
 import os
 import re
 import sys
+import time
 
 from .failmanager import FailManagerEmpty, FailManager
 from .ipdns import DNSUtils, IPAddr
@@ -85,6 +86,8 @@ def __init__(self, jail, useDns='warn'):
 		self.__lastDate = None
 		## External command
 		self.__ignoreCommand = False
+		## Error counter
+		self.__errors = 0
 
 		self.dateDetector = DateDetector()
 		self.dateDetector.addDefaultTemplate()
@@ -414,26 +417,41 @@ def processLine(self, line, date=None, returnRawHost=False,
 	def processLineAndAdd(self, line, date=None):
 		"""Processes the line for failures and populates failManager
 		"""
-		for element in self.processLine(line, date)[1]:
-			ip = element[1]
-			unixTime = element[2]
-			lines = element[3]
-			fail = {}
-			if len(element) > 4:
-				fail = element[4]
-			logSys.debug("Processing line with time:%s and ip:%s", 
-					unixTime, ip)
-			if unixTime < MyTime.time() - self.getFindTime():
-				logSys.debug("Ignore line since time %s < %s - %s", 
-					unixTime, MyTime.time(), self.getFindTime())
-				break
-			if self.inIgnoreIPList(ip, log_ignore=True):
-				continue
-			logSys.info(
-				"[%s] Found %s - %s", self.jail.name, ip, datetime.datetime.fromtimestamp(unixTime).strftime("%Y-%m-%d %H:%M:%S")
-			)
-			tick = FailTicket(ip, unixTime, lines, data=fail)
-			self.failManager.addFailure(tick)
+		try:
+			for element in self.processLine(line, date)[1]:
+				ip = element[1]
+				unixTime = element[2]
+				lines = element[3]
+				fail = {}
+				if len(element) > 4:
+					fail = element[4]
+				logSys.debug("Processing line with time:%s and ip:%s", 
+						unixTime, ip)
+				if unixTime < MyTime.time() - self.getFindTime():
+					logSys.debug("Ignore line since time %s < %s - %s", 
+						unixTime, MyTime.time(), self.getFindTime())
+					break
+				if self.inIgnoreIPList(ip, log_ignore=True):
+					continue
+				logSys.info(
+					"[%s] Found %s - %s", self.jail.name, ip, datetime.datetime.fromtimestamp(unixTime).strftime("%Y-%m-%d %H:%M:%S")
+				)
+				tick = FailTicket(ip, unixTime, lines, data=fail)
+				self.failManager.addFailure(tick)
+			# reset (halve) error counter (successfully processed line):
+			if self.__errors:
+				self.__errors //= 2
+		except Exception as e:
+			logSys.error("Failed to process line: %r, caught exception: %r", line, e,
+				exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
+			# incr error counter, stop processing (going idle) after 100th error :
+			self.__errors += 1
+			# sleep a little bit (to get around time-related errors):
+			time.sleep(self.sleeptime)
+			if self.__errors >= 100:
+				logSys.error("Too many errors at once (%s), going idle", self.__errors)
+				self.__errors //= 2
+				self.idle = True
 
 	##
 	# Returns true if the line should be ignored.


Test patch:
diff --git a/fail2ban/tests/files/logs/zzz-generic-example b/fail2ban/tests/files/logs/zzz-generic-example
--- a/fail2ban/tests/files/logs/zzz-generic-example
+++ b/fail2ban/tests/files/logs/zzz-generic-example
@@ -29,3 +29,19 @@ Jun 21 16:55:02   <auth.info> machine kernel: [  970.699396] @vserver_demo test-
 # -- the same as above with brackets as date ambit --
 # failJSON: { "time": "2005-06-21T16:55:03", "match": true , "host": "192.0.2.3" }
 [Jun 21 16:55:03] <auth.info> machine kernel: [  970.699396] @vserver_demo test-demo(pam_unix)[13709] [ID 255 test] F2B: failure from 192.0.2.3
+
+# -- wrong time direct in journal-line (used last known date):
+# failJSON: { "time": "2005-06-21T16:55:03", "match": true , "host": "192.0.2.1" }
+0000-12-30 00:00:00 server test-demo[47831]:  F2B: failure from 192.0.2.1
+# -- wrong time after newline in message (plist without escaped newlines):
+# failJSON: { "match": false }
+Jun 22 20:37:04 server test-demo[402]: writeToStorage plist={
+# failJSON: { "match": false }
+             absentCircleWithNoReason = 0;
+# failJSON: { "match": false }
+             applicationDate = "0000-12-30 00:00:00 +0000";
+# failJSON: { "match": false }
+}
+# -- wrong time direct in journal-line (used last known date):
+# failJSON: { "time": "2005-06-22T20:37:04", "match": true , "host": "192.0.2.2" }
+0000-12-30 00:00:00 server test-demo[47831]:  F2B: failure from 192.0.2.2
diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py
--- a/fail2ban/tests/filtertestcase.py
+++ b/fail2ban/tests/filtertestcase.py
@@ -604,6 +604,28 @@ def testNoLogFile(self):
 		self.filter.getFailures(self.name)
 		self.assertLogged('Unable to open %s' % self.name)
 
+	def testErrorProcessLine(self):
+		self.filter.sleeptime /= 1000.0
+		## produce error with not callable processLine:
+		_org_processLine = self.filter.processLine
+		self.filter.processLine = None
+		for i in range(100):
+			self.file.write("line%d\n" % 1)
+		self.file.flush()
+		for i in range(100):
+			self.filter.getFailures(self.name)
+		self.assertLogged('Failed to process line:')
+		self.assertLogged('Too many errors at once')
+		self.pruneLog()
+		self.assertTrue(self.filter.idle)
+		self.filter.idle = False
+		self.filter.getFailures(self.name)
+		self.filter.processLine = _org_processLine
+		self.file.write("line%d\n" % 1)
+		self.file.flush()
+		self.filter.getFailures(self.name)
+		self.assertNotLogged('Failed to process line:')
+
 	def testRemovingFailRegex(self):
 		self.filter.delFailRegex(0)
 		self.assertNotLogged('Cannot remove regular expression. Index 0 is not valid')