fail2ban/fail2ban — Issue #1: Support other date/time formats
Author: easyjohn
Created: 2011-10-22 18:59:57+00:00
State: open

Support other date/time formats or create date profiles.

Fail2ban error:
2011.07.11 21:09:40 host(daemon.debug) fail2ban.filter : DEBUG Found a match for '2011.07.11 21:09:39 host(auth.info) sshd[19750]: Invalid user serial from 202.102.52.202 2011.07.11 21:09:40 host(user.notice) ' but no valid date/time found for '2011.07.11 21:09:39 host(auth.info) sshd[19750]: Invalid user serial from 202.102.52.202 2011.07.11 21:09:40 host(user.notice) '. Please contact the author in order to get support for this format

I use syslog-ng with:
destination d_messages { file("/var/log/messages" template("$R_YEAR.$R_MONTH.$R_DAY $R_HOUR:$R_MIN:$R_SEC $HOST($FACILITY.$PRIORITY) $MSGHDR$MSG\n") ); };

Sample line of syslog:
2011.07.11 21:09:39 host(auth.info) sshd[19750]: Invalid user serial from 202.102.52.202