suppress unneeded info (moved to debug level)

see #3186
2021-12-20 15:39:57 +01:00
94 changed files with 496 additions and 3340 deletions
@@ -1 +0,0 @@
-ChangeLog linguist-language=Markdown
@@ -0,0 +1,49 @@
+_We will be very grateful, if your problem was described as completely as possible,
+enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
+within INFO mode), and configuration in particular of effected relevant settings
+(e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
+jail troubleshooting).
+Thank you in advance for the details, because such issues like "It does not work" 
+alone could not help to resolve anything!
+Thanks! (remove this paragraph and other comments upon reading)_
+
+### Environment:
+
+_Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
+and you can't verify that the issue persists in the recent release, better seek support 
+from the distribution you obtained Fail2Ban from_
+
+- Fail2Ban version (including any possible distribution suffixes):
+- OS, including release name/version: 
+- [ ] Fail2Ban installed via OS/distribution mechanisms
+- [ ] You have not applied any additional foreign patches to the codebase
+- [ ] Some customizations were done to the configuration (provide details below is so)
+
+### The issue:
+
+_Summary here_
+
+#### Steps to reproduce
+
+#### Expected behavior
+
+#### Observed behavior
+
+#### Any additional information
+
+### Configuration, dump and another helpful excerpts
+
+#### Any customizations done to /etc/fail2ban/ configuration
+```
+```
+
+#### Relevant parts of /var/log/fail2ban.log file:
+_preferably obtained while running fail2ban with `loglevel = 4`_
+
+```
+```
+
+#### Relevant lines from monitored log files in question:
+
+```
+```
@@ -1,70 +0,0 @@
---
-name: Bug report
-about: Report a bug within the fail2ban engines (not filters or jails)
-title: '[BR]: '
-labels: bug
-assignees: ''
-
---
-
-<!--
-  - Before reporting, please make sure to search the open and closed issues for any reports in the past.
-  - Use this issue template to report a bug in the fail2ban engine (not in a filter or jail).
-  - If you want to request a feature or a new filter, please use "Feature request" or "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
-
-  We will be very grateful, if your problem was described as completely as possible,
-  enclosing excerpts from logs (if possible within DEBUG mode, if no errors evident
-  within INFO mode), and configuration in particular of effected relevant settings
-  (e.g., with ` fail2ban-client -d | grep 'affected-jail-name' ` for a particular
-  jail troubleshooting).
-  Thank you in advance for the details, because such issues like "It does not work" 
-  alone could not help to resolve anything!
-  Thanks! 
-  (you can remove this paragraph and other comments upon reading)
-->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply. If your Fail2Ban version is outdated, 
-  and you can't verify that the issue persists in the recent release, better seek support 
-  from the distribution you obtained Fail2Ban from
-->
-
- Fail2Ban version <!-- including any possible distribution suffixes --> : 
- OS, including release name/version : 
- [ ] Fail2Ban installed via OS/distribution mechanisms
- [ ] You have not applied any additional foreign patches to the codebase
- [ ] Some customizations were done to the configuration (provide details below is so)
-
-### The issue:
-
-<!-- summary here -->
-
-#### Steps to reproduce
-
-#### Expected behavior
-
-#### Observed behavior
-
-#### Any additional information
-
-
-### Configuration, dump and another helpful excerpts
-
-#### Any customizations done to /etc/fail2ban/ configuration
-<!-- put your configuration excerpts between next 2 lines -->
-```
-```
-
-#### Relevant parts of /var/log/fail2ban.log file:
-<!-- preferably obtained while running fail2ban with `loglevel = 4` -->
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### Relevant lines from monitored log files:
-<!-- put your log excerpt between next 2 lines -->
-```
-```
@@ -1,35 +0,0 @@
---
-name: Feature request
-about: Suggest an idea or an enhancement for this project
-title: '[RFE]: '
-labels: enhancement
-assignees: ''
-
---
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Use this issue template to request a feature in the fail2ban engine (not a new filter or jail).
-  - If you want to request a new filter or failregex, please use "Filter request" instead.
-  - If you have rather some question, please open or join to some discussion.
-->
-
-#### Feature request type
-<!--
-  Please provide a summary description of the feature request.
-->
-
-#### Description
-<!--
-  Please describe the feature in more detail.
-->
-
-#### Considered alternatives
-<!--
-  A clear and concise description of any alternative solutions or features you've considered.
-->
-
-#### Any additional information
-<!--
-  Add any other context or screenshots about the feature request here.
-->
@@ -1,59 +0,0 @@
---
-name: Filter request
-about: Request a new jail or filter to be supported or existing filter extended with new failregex
-title: '[FR]: '
-labels: filter-request
-assignees: ''
-
---
-
-<!--
-  - Before requesting, please make sure to search the open and closed issues for any requests in the past.
-  - Sometimes failregex have been already requested before but are not implemented yet due to various reasons.
-  - If there are no hits for your concerns, please proceed otherwise add a comment to the related issue (also if it is closed).
-  - If you want to request a new feature, please use "Feature request" instead.
-  - If you have rather some question, please open or join to some discussion.
-->
-
-### Environment:
-
-<!--
-  Fill out and check (`[x]`) the boxes which apply.
-->
-
- Fail2Ban version <!-- including any possible distribution suffixes --> : 
- OS, including release name/version : 
-
-#### Service, project or product which log or journal should be monitored
-
- Name of filter or jail in Fail2Ban (if already exists) : 
- Service, project or product name, including release name/version : 
- Repository or URL (if known) : 
- Service type : 
- Ports and protocols the service is listening : 
-
-#### Log or journal information
-<!-- Delete unrelated group -->
-
-<!-- Log file -->
-
- Log file name(s) : 
-
-<!-- Systemd journal -->
-
- Journal identifier or unit name : 
-
-#### Any additional information
-
-
-### Relevant lines from monitored log files:
-
-#### failures in sense of fail2ban filter (fail2ban must match):
-<!-- put your log excerpt between next 2 lines -->
-```
-```
-
-#### legitimate messages (fail2ban should not consider as failures):
-<!-- put your log excerpt between next 2 lines -->
-```
-```
@@ -1,8 +1,7 @@
 Before submitting your PR, please review the following checklist:

 - [ ] **CHOOSE CORRECT BRANCH**: if filing a bugfix/enhancement
-      against certain release version, choose `0.9`, `0.10` or `0.11` branch,
-      for dev-edition use `master` branch
+      against 0.9.x series, choose `master` branch
 - [ ] **CONSIDER adding a unit test** if your PR resolves an issue
 - [ ] **LIST ISSUES** this PR resolves
 - [ ] **MAKE SURE** this PR doesn't break existing tests
@@ -6,69 +6,30 @@
 Fail2Ban: Changelog
 ===================

-ver. 1.0.1-dev-1 (20??/??/??) - development nightly edition
+ver. 0.10.6 (2020/11/23) - just-what-the-doctor-ordered
 -----------

-### Compatibility:
-* potential incompatibility by parsing of options of `backend`, `filter` and `action` parameters (if they
-  are partially incorrect), because fail2ban could throw an error now (doesn't silently bypass it anymore).
-* to v.0.11:
-  - due to change of `actioncheck` behavior (gh-488), some actions can be incompatible as regards
-    the invariant check, if `actionban` or `actionunban` would not throw an error (exit code 
-    different from 0) in case of unsane environment.
+### Incompatibility list (v.0.10 compared to v.0.9):
+* Filter (or `failregex`) internal capture-groups:

-### Fixes
-* readline fixed to consider interim new-line character as part of code point in multi-byte logs
-  (e. g. unicode encoding like utf-16be, utf-16le);
-* `action.d/ufw.conf`:
-  - fixed handling on IPv6 (using prepend, gh-2331, gh-3018)
-  - application names containing spaces can be used now (gh-656, gh-1532, gh-3018)
-* `filter.d/drupal-auth.conf` more strict regex, extended to match "Login attempt failed from" (gh-2742)
+  - If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should
+    rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)`
+    (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings).

-### New Features and Enhancements
-* `actioncheck` behavior is changed now (gh-488), so invariant check as well as restore or repair
-   of sane environment (in case of recognized unsane state) would only occur on action errors (e. g.
-   if ban or unban operations are exiting with other code as 0)
-* better recognition of log rotation, better performance by reopen: avoid unnecessary seek to begin of file
-  (and hash calculation)
-* file filter reads only complete lines (ended with new-line) now, so waits for end of line (for its completion)
-* `action.d/ufw.conf` (gh-3018):
-  - new option `add` (default `prepend`), can be supplied as `insert 1` for ufw versions before v.0.36 (gh-2331, gh-3018)
-  - new options `kill-mode` and `kill` to drop established connections of intruder (see action for details, gh-3018)
-* `filter.d/nginx-http-auth.conf` - extended with parameter mode, so additionally to `auth` (or `normal`) 
-   mode `fallback` (or combined as `aggressive`) can find SSL errors while SSL handshaking, gh-2881
+    Of course you can always define your own capture-group (like below `_cond_ip_`) to do this.
+    ```
+    testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1"
+    fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_><HOST>): bad host (?P=_cond_ip_)$"
+    ```
+  - New internal groups (currently reserved for internal usage):
+    `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if
+    mapping from tag `<F-*>` used in failregex (e. g. `user` by `<F-USER>`).

+* v.0.10 uses more precise date template handling, that can be theoretically incompatible to some
+  user configurations resp. `datepattern`.

-ver. 0.11.2 (2020/11/23) - heal-the-world-with-security-tools
-----------
-
-### Compatibility:
-* to v.0.10:
-  - 0.11 is totally compatible to 0.10 (configuration- and API-related stuff), but the database
-    got some new tables and fields (auto-converted during the first start), so once updated to 0.11, you
-    have to remove the database /var/lib/fail2ban/fail2ban.sqlite3 (or its different to 0.10 schema)
-    if you would need to downgrade to 0.10 for some reason.
-* to v.0.9:
-  - Filter (or `failregex`) internal capture-groups:
-
-    * If you've your own `failregex` or custom filters using conditional match `(?P=host)`, you should
-      rewrite the regex like in example below resp. using `(?:(?P=ip4)|(?P=ip6)` instead of `(?P=host)`
-      (or `(?:(?P=ip4)|(?P=ip6)|(?P=dns))` corresponding your `usedns` and `raw` settings).
-
-      Of course you can always define your own capture-group (like below `_cond_ip_`) to do this.
-      ```
-      testln="1500000000 failure from 192.0.2.1: bad host 192.0.2.1"
-      fail2ban-regex "$testln" "^\s*failure from (?P<_cond_ip_><HOST>): bad host (?P=_cond_ip_)$"
-      ```
-    * New internal groups (currently reserved for internal usage):
-      `ip4`, `ip6`, `dns`, `fid`, `fport`, additionally `user` and another captures in lower case if
-      mapping from tag `<F-*>` used in failregex (e. g. `user` by `<F-USER>`).
-
-  - v.0.10 and 0.11 use more precise date template handling, that can be theoretically incompatible to some
-    user configurations resp. `datepattern`.
-
-  - Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are
-    IPv6-capable now.
+* Since v0.10 fail2ban supports the matching of IPv6 addresses, but not all ban actions are
+  IPv6-capable now.

 ### Fixes
 * [stability] prevent race condition - no ban if filter (backend) is continuously busy if
@@ -130,36 +91,6 @@ ver. 0.11.2 (2020/11/23) - heal-the-world-with-security-tools
    whereas filter will use now as timestamp (gh-2802)
 * performance optimization of `datepattern` (better search algorithm in datedetector, especially for single template);
 * fail2ban-client: extended to unban IP range(s) by subnet (CIDR/mask) or hostname (DNS), gh-2791;
-* extended capturing of alternate tags in filter, allowing combine of multiple groups to single tuple token with new tag
-  prefix `<F-TUPLE_`, that would combine value of `<F-V>` with all value of `<F-TUPLE_V?_n?>` tags (gh-2755)
-
-
-ver. 0.11.1 (2020/01/11) - this-is-the-way
-----------
-
-### Fixes
-* purge database will be executed now (within observer).
-* restoring currently banned ip after service restart fixed 
-  (now < timeofban + bantime), ignore old log failures (already banned)
-* upgrade database: update new created table `bips` with entries from table `bans` (allows restore
-  current bans after upgrade from version <= 0.10)
-
-### New Features
-* Increment ban time (+ observer) functionality introduced.
-* Database functionality extended with bad ips.
-* New tags (usable in actions):
-  - `<bancount>` - ban count of this offender if known as bad (started by 1 for unknown)
-  - `<bantime>` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.)
-* Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected);
-  Several actions (like ipset, etc.) rewritten using net logic with `actionprolong`.
-  Note: because ban-time is dynamic, it was removed from jail.conf as timeout argument (check jail.local).
-
-### Enhancements
-* algorithm of restore current bans after restart changed: update the restored ban-time (and therefore 
-  end of ban) of the ticket with ban-time of jail (as maximum), for all tickets with ban-time greater
-  (or persistent); not affected if ban-time of the jail is unchanged between stop/start.
-* added new setup-option `--without-tests` to skip building and installing of tests files (gh-2287).
-* added new command `fail2ban-client get <JAIL> banip ?sep-char|--with-time?` to get the banned ip addresses (gh-1916).


 ver. 0.10.5 (2020/01/10) - deserve-more-respect-a-jedis-weapon-must
@@ -222,7 +153,7 @@ Yes, Hrrrm...
 ### New Features
 * new replacement tags for failregex to match subnets in form of IP-addresses with CIDR mask (gh-2559):
  - `<CIDR>` - helper regex to match CIDR (simple integer form of net-mask);
-  - `<SUBNET>` - regex to match sub-net addresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional);
+  - `<SUBNET>` - regex to match sub-net adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional);
 * grouped tags (`<ADDR>`, `<HOST>`, `<SUBNET>`) recognize IP addresses enclosed in square brackets
 * new failregex-flag tag `<F-MLFGAINED>` for failregex, signaled that the access to service was gained
  (ATM used similar to tag `<F-NOFAIL>`, but it does not add the log-line to matches, gh-2279)
@@ -540,14 +471,9 @@ TODO: implementing of options resp. other tasks from PR #1346
  - `<fid>` - failure identifier (if raw resp. failures without IP address)
  - `<ip-rev>` - PTR reversed representation of IP address
  - `<ip-host>` - host name of the IP address
-  - `<bancount>` - ban count of this offender if known as bad (started by 1 for unknown)
-  - `<bantime>` - current ban-time of the ticket (prolongation can be retarded up to 10 sec.)
  - `<F-...>` - interpolates to the corresponding filter group capture `...`
  - `<fq-hostname>` - fully-qualified name of host (the same as `$(hostname -f)`)
  - `<sh-hostname>` - short hostname (the same as `$(uname -n)`)
-* Introduced new action command `actionprolong` to prolong ban-time (e. g. set new timeout if expected);
-  Several actions (like ipset, etc.) rewritten using net logic with `actionprolong`.
-  Note: because ban-time is dynamic, it was removed from jail.conf as timeout argument (check jail.local).
 * Allow to use filter options by `fail2ban-regex`, example:
  fail2ban-regex text.log "sshd[mode=aggressive]"
 * Samples test case factory extended with filter options - dict in JSON to control 
@@ -621,9 +547,6 @@ ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc
 * testSocket: sporadical bug repaired - wait for server thread starts a socket (listener)
 * testExecuteTimeoutWithNastyChildren: sporadical bug repaired - wait for pid file inside bash,
  kill tree in any case (gh-1155)
-* purge database will be executed now (within observer).
-* restoring currently banned ip after service restart fixed 
-  (now < timeofban + bantime), ignore old log failures (already banned)
 * Fixed high-load of pyinotify-backend,
  see https://github.com/fail2ban/fail2ban/issues/885#issuecomment-248964591
 * Database: stability fix - repack cursor iterator as long as locked
@@ -661,9 +584,6 @@ ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc
    - new conditional section functionality used in config resp. includes:
      - [Init?family=inet4] - IPv4 qualified hosts only
      - [Init?family=inet6] - IPv6 qualified hosts only
-* Increment ban time (+ observer) functionality introduced.
-  Thanks Serg G. Brester (sebres)
-* Database functionality extended with bad ips.
 * New reload functionality (now totally without restart, unbanning/rebanning, etc.),
  see gh-1557
 * Several commands extended and new commands introduced:
@@ -1,7 +0,0 @@
-FROM python:3.10-slim
-
-WORKDIR /root
-COPY setup.py fail2ban config bin ./
-RUN python setup.py install
-
-ENTRYPOINT ["/bin/fail2ban-server"]
@@ -278,7 +278,6 @@ to tune it.  fail2ban-regex -D ...  will present Debuggex URLs for the regexs
 and sample log files that you pass into it.

 In general use when using regex debuggers for generating fail2ban filters:
-
 * use regex from the ./fail2ban-regex output (to ensure all substitutions are
 done)
 * replace <HOST> with (?&.ipv4)
@@ -3,7 +3,6 @@ bin/fail2ban-regex
 bin/fail2ban-server
 bin/fail2ban-testcases
 ChangeLog
-config/action.d/apprise.conf
 config/action.d/abuseipdb.conf
 config/action.d/apf.conf
 config/action.d/blocklist_de.conf
@@ -209,7 +208,6 @@ fail2ban/server/jail.py
 fail2ban/server/jails.py
 fail2ban/server/jailthread.py
 fail2ban/server/mytime.py
-fail2ban/server/observer.py
 fail2ban/server/server.py
 fail2ban/server/strptime.py
 fail2ban/server/ticket.py
@@ -265,7 +263,6 @@ fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd
 fail2ban/tests/files/config/apache-auth/noentry/.htaccess
 fail2ban/tests/files/config/apache-auth/README
 fail2ban/tests/files/database_v1.db
-fail2ban/tests/files/database_v2.db
 fail2ban/tests/files/filter.d/substition.conf
 fail2ban/tests/files/filter.d/testcase01.conf
 fail2ban/tests/files/filter.d/testcase02.conf
@@ -376,7 +373,6 @@ fail2ban/tests/files/zzz-sshd-obsolete-multiline.log
 fail2ban/tests/filtertestcase.py
 fail2ban/tests/__init__.py
 fail2ban/tests/misctestcase.py
-fail2ban/tests/observertestcase.py
 fail2ban/tests/samplestestcase.py
 fail2ban/tests/servertestcase.py
 fail2ban/tests/sockettestcase.py
@@ -1,5 +0,0 @@
-setup:
-	docker-compose -f docker-compose.yml up --build -d
-clean:
-	docker-compose down
-	docker image rm fail2ban
@@ -2,7 +2,7 @@
                        / _|__ _(_) |_  ) |__  __ _ _ _  
                       |  _/ _` | | |/ /| '_ \/ _` | ' \ 
                       |_| \__,_|_|_/___|_.__/\__,_|_||_|
-                       v1.0.1.dev1            20??/??/??
+                       v0.10.3.dev1            20??/??/??

 ## Fail2Ban: ban hosts that cause multiple authentication errors

@@ -18,12 +18,11 @@ attempts, it cannot eliminate the risk presented by weak authentication.
 Set up services to use only two factor, or public/private authentication
 mechanisms if you really want to protect services.
     
-<img src="http://www.worldipv6launch.org/wp-content/themes/ipv6/downloads/World_IPv6_launch_logo.svg" height="52pt"/> | Since v0.10 fail2ban supports the matching of IPv6 addresses.
+<img src="http://www.worldipv6launch.org/wp-content/themes/ipv6/downloads/World_IPv6_launch_logo.svg" height="52pt"/> | Since v0.10 fail2ban supports the matching of the IPv6 addresses.
 ------|------

 This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
-to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki),
-[Developers documentation](https://fail2ban.readthedocs.io/)
+to be found on fail2ban(1) manpage, [Wiki](https://github.com/fail2ban/fail2ban/wiki)
 and the website: https://www.fail2ban.org

 Installation:
@@ -34,7 +33,6 @@ this case, you should use that instead.**

 Required:
 - [Python2 >= 2.6 or Python >= 3.2](https://www.python.org) or [PyPy](https://pypy.org)
- python-setuptools, python-distutils or python3-setuptools for installation from source

 Optional:
 - [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify), may require:
@@ -47,16 +45,10 @@ Optional:

 To install:

-    tar xvfj fail2ban-1.0.1.tar.bz2
-    cd fail2ban-1.0.1
-    sudo python setup.py install
-   
-Alternatively, you can clone the source from GitHub to a directory of Your choice, and do the install from there. Pick the correct branch, for example, master or 0.11
+    tar xvfj fail2ban-0.10.3.tar.bz2
+    cd fail2ban-0.10.3
+    python setup.py install

-    git clone https://github.com/fail2ban/fail2ban.git
-    cd fail2ban
-    sudo python setup.py install 
-    
 This will install Fail2Ban into the python library directory. The executable
 scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`.

@@ -66,9 +58,6 @@ Fail2Ban should be correctly installed now. Just type:

 to see if everything is alright. You should always use fail2ban-client and
 never call fail2ban-server directly.
-You can verify that you have the correct version installed with 
-
-    fail2ban-client version

 Please note that the system init/service script is not automatically installed.
 To enable fail2ban as an automatic service, simply copy the script for your
@@ -90,11 +79,11 @@ fail2ban(1) and jail.conf(5)  manpages for further references.
 Code status:
 ------------

-* travis-ci.org: [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=master)](https://travis-ci.org/fail2ban/fail2ban?branch=master) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.11)](https://travis-ci.org/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.svg?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) (0.10 branch) 
+* [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=0.10)](https://travis-ci.org/fail2ban/fail2ban?branch=0.10) travis-ci.org (0.10 branch) / [![tests status](https://secure.travis-ci.org/fail2ban/fail2ban.png?branch=master)](https://travis-ci.org/fail2ban/fail2ban) travis-ci.org (master branch)

-* coveralls.io: [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=master)](https://coveralls.io/github/fail2ban/fail2ban?branch=master) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.11)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.11) (0.11 branch) / [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.svg?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10) / (0.10 branch)
+* [![Coverage Status](https://coveralls.io/repos/fail2ban/fail2ban/badge.png?branch=0.10)](https://coveralls.io/github/fail2ban/fail2ban?branch=0.10)

-* codecov.io: [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=master)](https://codecov.io/gh/fail2ban/fail2ban/branch/master) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.11)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.11) (0.11 branch) / [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10) (0.10 branch)
+* [![codecov.io](https://codecov.io/gh/fail2ban/fail2ban/coverage.svg?branch=0.10)](https://codecov.io/gh/fail2ban/fail2ban/branch/0.10)

 Contact:
 --------
@@ -111,7 +111,7 @@ Russell Odom
 SATO Kentaro
 Sean DuBois
 Sebastian Arcus
-Serg G. Brester (sebres)
+Serg G. Brester
 Sergey Safarov
 Shaun C.
 Sireyessire
@@ -1,49 +0,0 @@
-# Fail2Ban configuration file
-#
-# Author: Chris Caron <lead2gold@gmail.com>
-#
-#
-
-[Definition]
-
-# Option:  actionstart
-# Notes.:  command executed once at the start of Fail2Ban.
-# Values:  CMD
-#
-actionstart = printf %%b "The jail <name> as been started successfully." | <apprise> -t "[Fail2Ban] <name>: started on `uname -n`"
-
-# Option:  actionstop
-# Notes.:  command executed once at the end of Fail2Ban
-# Values:  CMD
-#
-actionstop = printf %%b "The jail <name> has been stopped." | <apprise> -t "[Fail2Ban] <name>: stopped on `uname -n`"
-
-# Option:  actioncheck
-# Notes.:  command executed once before each actionban command
-# Values:  CMD
-#
-actioncheck =
-
-# Option:  actionban
-# Notes.:  command executed when banning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionban = printf %%b "The IP <ip> has just been banned by Fail2Ban after <failures> attempts against <name>" | <apprise> -n "warning" -t "[Fail2Ban] <name>: banned <ip> from `uname -n`"
-
-# Option:  actionunban
-# Notes.:  command executed when unbanning an IP. Take care that the
-#          command is executed with Fail2Ban user rights.
-# Tags:    See jail.conf(5) man page
-# Values:  CMD
-#
-actionunban =
-
-[Init]
-
-# Define location of the default apprise configuration file to use
-#
-config = /etc/fail2ban/apprise.conf
-#
-apprise = apprise -c "<config>"
@@ -18,46 +18,19 @@ before = firewallcmd-common.conf

 [Definition]

-actionstart = <ipstype_<ipsettype>/actionstart>
-              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-
-actionflush = <ipstype_<ipsettype>/actionflush>
-
-actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
-             <actionflush>
-             <ipstype_<ipsettype>/actionstop>
-
-actionban = <ipstype_<ipsettype>/actionban>
-
-# actionprolong = %(actionban)s
-
-actionunban = <ipstype_<ipsettype>/actionunban>
-
-[ipstype_ipset]
-
 actionstart = ipset create <ipmset> hash:ip timeout <default-ipsettime> <familyopt>
+              firewall-cmd --direct --add-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>

 actionflush = ipset flush <ipmset>

-actionstop = ipset destroy <ipmset>
+actionstop = firewall-cmd --direct --remove-rule <family> filter <chain> 0 <actiontype> -m set --match-set <ipmset> src -j <blocktype>
+             <actionflush>
+             ipset destroy <ipmset>

 actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist

 actionunban = ipset del <ipmset> <ip> -exist

-[ipstype_firewalld]
-
-actionstart = firewall-cmd --direct --new-ipset=<ipmset> --type=hash:ip --option=timeout=<default-ipsettime> <firewalld_familyopt>
-
-# TODO: there doesn't seem to be an explicit way to invoke the ipset flush function using firewall-cmd
-actionflush = 
-
-actionstop = firewall-cmd --direct --delete-ipset=<ipmset>
-
-actionban = firewall-cmd --ipset=<ipmset> --add-entry=<ip>
-
-actionunban = firewall-cmd --ipset=<ipmset> --remove-entry=<ip>
-
 [Init]

 # Option:  chain
@@ -81,12 +54,6 @@ ipsettime = 0
 # banaction = %(known/banaction)s[ipsettime='<timeout-bantime>']
 timeout-bantime = $([ "<bantime>" -le 2147483 ] && echo "<bantime>" || echo 0)

-# Option: ipsettype
-# Notes.: defines type of ipset used for match-set (firewalld or ipset)
-# Values: firewalld or ipset
-# Default: ipset
-ipsettype = ipset
-
 # Option: actiontype
 # Notes.: defines additions to the blocking rule
 # Values: leave empty to block all attempts from the host
@@ -106,16 +73,14 @@ multiport = -p <protocol> -m multiport --dports <port>

 ipmset = f2b-<name>
 familyopt =
-firewalld_familyopt =

 [Init?family=inet6]

 ipmset = f2b-<name>6
 familyopt = family inet6
-firewalld_familyopt = --option=family=inet6


 # DEV NOTES:
 #
-# Author: Edgar Hoch, Daniel Black, Sergey Brester and Mihail Politaev
+# Author: Edgar Hoch and Daniel Black
 # firewallcmd-new / iptables-ipset-proto6 combined for maximium goodness
@@ -51,8 +51,6 @@ actionstop = <iptables> -D <chain> -m set --match-set <ipmset> src -j <blocktype
 #
 actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist

-# actionprolong = %(actionban)s
-
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -51,8 +51,6 @@ actionstop = <iptables> -D <chain> -p <protocol> -m multiport --dports <port> -m
 #
 actionban = ipset add <ipmset> <ip> timeout <ipsettime> -exist

-# actionprolong = %(actionban)s
-
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -12,5 +12,5 @@ actioncheck =
 actionban = /usr/libexec/afctl -a <ip> -t <bantime>
 actionunban = /usr/libexec/afctl -r <ip>

-actionprolong = %(actionunban)s && %(actionban)s
-
+[Init]
+bantime = 2880
@@ -68,8 +68,6 @@ actionstop = ipset flush f2b-<name>
 #
 actionban = ipset add f2b-<name> <ip> timeout <ipsettime> -exist

-# actionprolong = %(actionban)s
-
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
@@ -13,45 +13,16 @@ actionstop =

 actioncheck = 

-# ufw does "quickly process packets for which we already have a connection" in before.rules,
-# therefore all related sockets should be closed
-# actionban is using `ss` to do so, this only handles IPv4 and IPv6.
+actionban = [ -n "<application>" ] && app="app <application>"
+            ufw insert <insertpos> <blocktype> from <ip> to <destination> $app

-actionban = if [ -n "<application>" ] && ufw app info "<application>"
-            then
-              ufw <add> <blocktype> from <ip> to <destination> app "<application>" comment "<comment>"
-            else
-              ufw <add> <blocktype> from <ip> to <destination> comment "<comment>"
-            fi
-            <kill>
-
-actionunban = if [ -n "<application>" ] && ufw app info "<application>"
-              then
-                ufw delete <blocktype> from <ip> to <destination> app "<application>"
-              else
-                ufw delete <blocktype> from <ip> to <destination>
-              fi
-
-# Option: kill-mode
-# Notes.: can be set to ss or conntrack (may be extended later with other modes) to immediately drop all connections from banned IP, default empty (no kill)
-# Example: banaction = ufw[kill-mode=ss]
-kill-mode =
-
-# intern conditional parameter used to provide killing mode after ban:
-_kill_ =
-_kill_ss = ss -K dst "[<ip>]"
-_kill_conntrack = conntrack -D -s "<ip>"
-
-# Option: kill
-# Notes.: can be used to specify custom killing feature, by default depending on option kill-mode
-# Examples: banaction = ufw[kill='ss -K "( sport = :http || sport = :https )" dst "[<ip>]"']
-#           banaction = ufw[kill='cutter "<ip>"']
-kill = <_kill_<kill-mode>>
+actionunban = [ -n "<application>" ] && app="app <application>"
+              ufw delete <blocktype> from <ip> to <destination> $app

 [Init]
-# Option: add
-# Notes.: can be set to "insert 1" to insert a rule at certain position (here 1):
-add = prepend
+# Option: insertpos
+# Notes.:  The position number in the firewall list to insert the block rule
+insertpos = 1

 # Option: blocktype
 # Notes.: reject or deny
@@ -65,10 +36,6 @@ destination = any
 # Notes.: application from sudo ufw app list
 application = 

-# Option: comment
-# Notes.: comment for rule added by fail2ban
-comment = by Fail2Ban after <failures> attempts against <name>
-
 # DEV NOTES:
 # 
 # Author: Guilhem Lettron
@@ -2,11 +2,11 @@

 [Definition]

-failregex = ^\s*<HOST> \S+ \S+(?: \S+)?\s+\S+ "[A-Z]+ /\S* [^"]*" \d+ \d+ \"[^"]*\" "[^"]*\bGooglebot/[^"]*"
+failregex = ^<HOST> .*Googlebot.*$

 ignoreregex =

-datepattern = ^[^\[]*(\[{DATE}\s*\])
+datepattern = ^[^\[]*\[({DATE})
              {^LN-BEG}

 # DEV Notes:
@@ -21,7 +21,7 @@ log_prefix= (?:NOTICE|SECURITY|WARNING)%(__pid_re)s:?(?:\[C-[\da-f]*\])?:? [^:]+
 prefregex = ^%(__prefix_line)s%(log_prefix)s <F-CONTENT>.+</F-CONTENT>$

 failregex = ^Registration from '[^']*' failed for '<HOST>(:\d+)?' - (?:Wrong password|Username/auth name mismatch|No matching peer found|Not a local domain|Device does not match ACL|Peer is not supposed to register|ACL error \(permit/deny\)|Not a local domain)$
-            ^Call from '[^']*' \((?:(?:TCP|UDP):)?<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
+            ^Call from '[^']*' \(<HOST>:\d+\) to extension '[^']*' rejected because extension not found in context
            ^(?:Host )?<HOST> (?:failed (?:to authenticate\b|MD5 authentication\b)|tried to authenticate with nonexistent user\b)
            ^No registration for peer '[^']*' \(from <HOST>\)$
            ^hacking attempt detected '<HOST>'$
@@ -14,7 +14,7 @@ before = common.conf

 [Definition]

-failregex = ^%(__prefix_line)s(?:https?:\/\/)[^|]+\|[^|]+\|[^|]+\|<ADDR>\|(?:[^|]*\|)*Login attempt failed (?:for|from) <F-USER>[^|]+</F-USER>\.$
+failregex = ^%(__prefix_line)s(https?:\/\/)([\da-z\.-]+)\.([a-z\.]{2,6})(\/[\w\.-]+)*\|\d{10}\|user\|<HOST>\|.+\|.+\|\d\|.*\|Login attempt failed for .+\.$

 ignoreregex =

@@ -1,25 +0,0 @@
-# Fail2Ban filter for Monitorix (HTTP built-in server)
-#
-
-[INCLUDES]
-
-before = common.conf
-
-[Definition]
-
-_daemon = monitorix-httpd
-
-# Option:  failregex
-# Notes.:  regex to match the password failures messages in the logfile. The
-#          host must be matched by a group named "host". The tag "<HOST>" can
-#          be used for standard IP/hostname matching and is only an alias for
-#          (?:::f{4,6}:)?(?P<host>\S+)
-# Values:  TEXT
-#
-failregex = ^(?:\s+-)?\s*(?:NOTEXIST|AUTHERR|NOTALLOWED) - <ADDR>\b
-
-# Option:  ignoreregex
-# Notes.:  regex to ignore. If this regex matches, the line is ignored.
-# Values:  TEXT
-#
-ignoreregex =
@@ -1,15 +0,0 @@
-# Fail2Ban filter for failed MSSQL Server authentication attempts
-
-[Definition]
-
-failregex = ^\s*Logon\s+Login failed for user '<F-USER>(?:[^']*|.*)</F-USER>'\. [^'\[]+\[CLIENT: <ADDR>\]$
-
-
-# DEV Notes:
-#	Tested with SQL Server 2019 on Ubuntu 18.04
-#
-# Example:
-#	2020-02-24 14:48:55.12 Logon       Login failed for user 'root'. Reason: Could not find a login matching the name provided. [CLIENT: 127.0.0.1]
-#
-# Author: Rüdiger Olschewsky
-#
@@ -1,16 +0,0 @@
-# Fail2Ban filter to match bad requests to nginx
-#
-
-[Definition]
-
-# The request often doesn't contain a method, only some encoded garbage
-# This will also match requests that are entirely empty
-failregex = ^<HOST> - \S+ \[\] "[^"]*" 400
-
-datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
-              ^[^\[]*\[({DATE})
-              {^LN-BEG}
-
-journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
-
-# Author: Jan Przybylak
@@ -17,9 +17,7 @@ datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]
              ^[^\[]*\[({DATE})
              {^LN-BEG}

-journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
-
 # DEV Notes:
 # Based on apache-botsearch filter
 # 
-# Author: Frantisek Sumsal
+# Author: Frantisek Sumsal
@@ -3,32 +3,15 @@

 [Definition]

-mode = normal

-mdre-auth = ^\s*\[error\] \d+#\d+: \*\d+ user "(?:[^"]+|.*?)":? (?:password mismatch|was not found in "[^\"]*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$
-mdre-fallback = ^\s*\[crit\] \d+#\d+: \*\d+ SSL_do_handshake\(\) failed \(SSL: error:\S+(?: \S+){1,3} too (?:long|short)\)[^,]*, client: <HOST>
-
-mdre-normal = %(mdre-auth)s
-mdre-aggressive = %(mdre-auth)s
-                  %(mdre-fallback)s
-
-failregex = <mdre-<mode>>
+failregex = ^ \[error\] \d+#\d+: \*\d+ user "(?:[^"]+|.*?)":? (?:password mismatch|was not found in "[^\"]*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$

 ignoreregex = 

 datepattern = {^LN-BEG}

-journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
-
 # DEV NOTES:
-# mdre-auth:
 # Based on samples in https://github.com/fail2ban/fail2ban/pull/43/files
 # Extensive search of all nginx auth failures not done yet.
 # 
 # Author: Daniel Black
-
-# mdre-fallback:
-# Ban people checking for TLS_FALLBACK_SCSV repeatedly
-# https://stackoverflow.com/questions/28010492/nginx-critical-error-with-ssl-handshaking/28010608#28010608
-# Author: Stephan Orlowsky
-
@@ -44,6 +44,3 @@ failregex = ^\s*\[[a-z]+\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by
 ignoreregex = 

 datepattern = {^LN-BEG}
-
-journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
-
@@ -22,10 +22,10 @@ _daemon = nsd
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT

-failregex =  ^%(__prefix_line)sinfo: ratelimit block .* query <ADDR> TYPE255$
-             ^%(__prefix_line)sinfo: .* from(?: client)? <ADDR> refused, no acl matches\.?$
+failregex =  ^%(__prefix_line)sinfo: ratelimit block .* query <HOST> TYPE255$
+             ^%(__prefix_line)sinfo: .* <HOST> refused, no acl matches\.$

 ignoreregex =

 datepattern = {^LN-BEG}Epoch
-              {^LN-BEG}
+              {^LN-BEG}
@@ -16,11 +16,8 @@ _pref = [A-Z]{4}

 prefregex = ^%(__prefix_line)s<mdpr-<mode>> <F-CONTENT>.+</F-CONTENT>$

-# Extended RE for normal mode to match reject by unknown users or undeliverable address, can be set to empty to avoid this:
-exre-user = |[Uu](?:ser unknown|ndeliverable address)
-
 mdpr-normal = (?:\w+: (?:milter-)?reject:|(?:improper command pipelining|too many errors) after \S+)
-mdre-normal=^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|(?:Client host|Command|Data command) rejected|Relay access denied|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b
+mdre-normal=^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|User unknown|(?:Client host|Command|Data command) rejected|Relay access denied|(?:Host|Domain) not found|need fully-qualified hostname|match)\b
            ^from [^[]*\[<HOST>\]%(_port)s:?

 mdpr-auth = warning:
@@ -36,9 +33,7 @@ mdre-rbl  = ^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45]54 [45]\.7\.1 Service
 mdpr-more = %(mdpr-normal)s
 mdre-more = %(mdre-normal)s

-# Includes some of the log messages described in
-# <http://www.postfix.org/POSTSCREEN_README.html>.
-mdpr-ddos = (?:lost connection after(?! DATA) [A-Z]+|disconnect(?= from \S+(?: \S+=\d+)* auth=0/(?:[1-9]|\d\d+))|(?:PREGREET \d+|HANGUP) after \S+|COMMAND (?:TIME|COUNT|LENGTH) LIMIT)
+mdpr-ddos = (?:lost connection after(?! DATA) [A-Z]+|disconnect(?= from \S+(?: \S+=\d+)* auth=0/(?:[1-9]|\d\d+)))
 mdre-ddos = ^from [^[]*\[<HOST>\]%(_port)s:?

 mdpr-extra = (?:%(mdpr-auth)s|%(mdpr-normal)s)
@@ -1,17 +0,0 @@
-# Fail2Ban filter for port scans detected by scanlogd
-
-[INCLUDES]
-
-# Read common prefixes. If any customizations available -- read them from
-# common.local
-before = common.conf
-
-[Definition]
-
-_daemon = scanlogd
-
-failregex =  ^%(__prefix_line)s<ADDR>(?::<F-PORT/>)? to \S+ ports\b
-
-ignoreregex =
-
-# Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
@@ -5,23 +5,17 @@ before = apache-common.conf

 [Definition]

-# patterns: [Mon Mar 28 16:50:49.522240 2016] [:error] [pid 1795] [client 10.1.1.1:50700] WAR [Login denied for user "username1"], referer: https://zoneminder/
-#           [Sun Mar 28 16:53:00.472693 2021] [php7:notice] [pid 11328] [client 10.1.1.1:39568] ERR [Could not retrieve user test details], referer: https://zm/
-#           [Sun Mar 28 16:59:14.150625 2021] [php7:notice] [pid 11336] [client 10.1.1.1:39654] ERR [Login denied for user "john"], referer: https://zm/
+# pattern: [Wed Apr 27 23:12:07.736196 2016] [:error] [pid 2460] [client 10.1.1.1:47296] WAR [Login denied for user "test"], referer: https://zoneminderurl/index.php
+#
 #
 # Option:  failregex
-# Notes.:  regex to match the login failure and non-existent user error messages in the logfile.
+# Notes.:  regex to match the password failure messages in the logfile.

-prefregex = ^%(_apache_error_client)s (?:ERR|WAR) <F-CONTENT>\[(?:Login denied|Could not retrieve).*</F-CONTENT>$
-
-failregex = ^\[Login denied for user "<F-USER>[^"]*</F-USER>"\]
-            ^\[Could not retrieve user <F-USER>\S*</F-USER>
+failregex = ^%(_apache_error_client)s WAR \[Login denied for user "[^"]*"\]

 ignoreregex =

 # Notes:
-#	Tested on Zoneminder 1.29 and 1.35.21
-#
-#	Zoneminder versions > 1.3x use "ERR" and < 1.3x use "WAR" level logs, so i've kept both for compatibility reasons
+#	Tested on Zoneminder 1.29.0
 #
 # Author: John Marzella
@@ -44,44 +44,6 @@ before = paths-debian.conf
 # MISCELLANEOUS OPTIONS
 #

-# "bantime.increment" allows to use database for searching of previously banned ip's to increase a 
-# default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...
-#bantime.increment = true
-
-# "bantime.rndtime" is the max number of seconds using for mixing with random time 
-# to prevent "clever" botnets calculate exact time IP can be unbanned again:
-#bantime.rndtime = 
-
-# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
-#bantime.maxtime = 
-
-# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier,
-# default value of factor is 1 and with default value of formula, the ban time 
-# grows by 1, 2, 4, 8, 16 ...
-#bantime.factor = 1
-
-# "bantime.formula" used by default to calculate next value of ban time, default value below,
-# the same ban time growing will be reached by multipliers 1, 2, 4, 8, 16, 32...
-#bantime.formula = ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor
-#
-# more aggressive example of formula has the same values only for factor "2.0 / 2.885385" :
-#bantime.formula = ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)
-
-# "bantime.multipliers" used to calculate next value of ban time instead of formula, corresponding
-# previously ban count and given "bantime.factor" (for multipliers default is 1);
-# following example grows ban time by 1, 2, 4, 8, 16 ... and if last ban count greater as multipliers count, 
-# always used last multiplier (64 in example), for factor '1' and original ban time 600 - 10.6 hours
-#bantime.multipliers = 1 2 4 8 16 32 64
-# following example can be used for small initial ban time (bantime=60) - it grows more aggressive at begin,
-# for bantime=60 the multipliers are minutes and equal: 1 min, 5 min, 30 min, 1 hour, 5 hour, 12 hour, 1 day, 2 day
-#bantime.multipliers = 1 5 30 60 300 720 1440 2880
-
-# "bantime.overalljails" (if true) specifies the search of IP in the database will be executed 
-# cross over all jails, if false (default), only current jail of the ban IP will be searched
-#bantime.overalljails = false
-
-# --------------------
-
 # "ignoreself" specifies whether the local resp. own IP addresses should be ignored
 # (default is true). Fail2ban will not ban a host which matches such addresses.
 #ignoreself = true
@@ -209,7 +171,7 @@ banaction = iptables-multiport
 banaction_allports = iptables-allports

 # The simplest action to take: ban only
-action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+action_ = %(banaction)s[bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

 # ban & send an e-mail with whois report to the destemail.
 action_mw = %(action_)s
@@ -227,15 +189,6 @@ action_mwl = %(action_)s
 action_xarf = %(action_)s
             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath="%(logpath)s", port="%(port)s"]

-# ban & send a notification to one or more of the 50+ services supported by Apprise.
-# See https://github.com/caronc/apprise/wiki for details on what is supported.
-#
-# You may optionally over-ride the default configuration line (containing the Apprise URLs)
-# by using 'apprise[config="/alternate/path/to/apprise.cfg"]' otherwise
-# /etc/fail2ban/apprise.conf is sourced for your supported notification configuration.
-# action = %(action_)s
-#          apprise
-
 # ban IP on CloudFlare & send an e-mail with whois report and relevant log lines
 # to the destemail.
 action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
@@ -370,11 +323,8 @@ banaction = %(banaction_allports)s
 logpath = /opt/openhab/logs/request.log


-# To use more aggressive http-auth modes set filter parameter "mode" in jail.local:
-# normal (default), aggressive (combines all), auth or fallback
-# See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details.
 [nginx-http-auth]
-# mode = normal
+
 port    = http,https
 logpath = %(nginx_error_log)s

@@ -390,10 +340,8 @@ logpath = %(nginx_error_log)s

 port     = http,https
 logpath  = %(nginx_error_log)s
+maxretry = 2

-[nginx-bad-request]
-port    = http,https
-logpath = %(nginx_access_log)s

 # Ban attackers that try to use PHP's URL-fopen() functionality
 # through GET/POST variables. - Experimental, with more than a year
@@ -797,14 +745,6 @@ logpath  = %(mysql_log)s
 backend  = %(mysql_backend)s


-[mssql-auth]
-# Default configuration for Microsoft SQL Server for Linux
-# See the 'mssql-conf' manpage how to change logpath or port
-logpath = /var/opt/mssql/log/errorlog
-port = 1433
-filter = mssql-auth
-
-
 # Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf')
 [mongodb-auth]
 # change port when running with "--shardsvr" or "--configsvr" runtime operation
@@ -970,11 +910,3 @@ logpath = %(apache_error_log)s
 # see `filter.d/traefik-auth.conf` for details and service example.
 port    = http,https
 logpath = /var/log/traefik/access.log
-
-[scanlogd]
-logpath = %(syslog_local0)s
-banaction = %(banaction_allports)s
-
-[monitorix]
-port	= 8080
-logpath = /var/log/monitorix-httpd
@@ -26,5 +26,3 @@ exim_main_log = /var/log/exim4/mainlog
 # was in debian squeezy but not in wheezy
 # /etc/proftpd/proftpd.conf (SystemLog)
 proftpd_log = /var/log/proftpd/proftpd.log
-
-roundcube_errors_log = /var/log/roundcube/errors.log
@@ -1,14 +0,0 @@
-version: "3.9"
-services:
-  fail2ban:
-    image: fail2ban
-    restart: unless-stopped
-    build:
-      context: .
-      dockerfile: ./Dockerfile
-    volumes:
-      - /var/run/fail2ban/fail2ban.sock # use fail2ban-client outside the container
-      - /var/log/auth.log:/var/log/auth.log
-      - ./config:/etc/fail2ban/config
-    stdin_open: true
-    tty: true
@@ -46,7 +46,6 @@ class ActionReader(DefinitionInitConfigReader):
 		"actionrepair": ["string", None],
 		"actionrepair_on_unban": ["bool", None],
 		"actionban": ["string", None],
-		"actionprolong": ["string", None],
 		"actionreban": ["string", None],
 		"actionunban": ["string", None],
 		"norestored": ["bool", None],
@@ -180,12 +180,6 @@ class Beautifier:
 					msg = "The jail %s action %s has the following " \
 						"methods:\n" % (inC[1], inC[3])
 					msg += ", ".join(response)
-			elif inC[2] == "banip" and inC[0] == "get":
-				if isinstance(response, list):
-					sep = " " if len(inC) <= 3 else inC[3]
-					if sep == "--with-time":
-						sep = "\n"
-					msg = sep.join(response)
 		except Exception:
 			logSys.warning("Beautifier error. Please report the error")
 			logSys.error("Beautify %r with %r failed", response, self.__inputCmd,
@@ -230,7 +230,7 @@ class Fail2banClient(Fail2banCmdLine, Thread):
 			logSys.log(5, '  client phase %s', phase)
 		if not stream:
 			return False
-		# wait a little bit for phase "start-ready" before enter active waiting:
+		# wait a litle bit for phase "start-ready" before enter active waiting:
 		if phase is not None:
 			Utils.wait_for(lambda: phase.get('start-ready', None) is not None, 0.5, 0.001)
 			phase['configure'] = (True if stream else False)
@@ -289,6 +289,9 @@ class Fail2banRegex(object):
 	def output(self, line):
 		if not self._opts.out: output(line)

+	def decode_line(self, line):
+		return FileContainer.decode_line('<LOG>', self._encoding, line)
+
 	def encode_line(self, line):
 		return line.encode(self._encoding, 'ignore')

@@ -720,6 +723,10 @@ class Fail2banRegex(object):

 		return True

+	def file_lines_gen(self, hdlr):
+		for line in hdlr:
+			yield self.decode_line(line)
+
 	def start(self, args):

 		cmd_log, cmd_regex = args[:2]
@@ -738,10 +745,10 @@ class Fail2banRegex(object):

 		if os.path.isfile(cmd_log):
 			try:
-				test_lines = FileContainer(cmd_log, self._encoding, doOpen=True)
-
+				hdlr = open(cmd_log, 'rb')
 				self.output( "Use         log file : %s" % cmd_log )
 				self.output( "Use         encoding : %s" % self._encoding )
+				test_lines = self.file_lines_gen(hdlr)
 			except IOError as e: # pragma: no cover
 				output( e )
 				return False
@@ -98,13 +98,6 @@ class JailReader(ConfigReader):
 		"maxmatches": ["int", None],
 		"findtime": ["string", None],
 		"bantime": ["string", None],
-		"bantime.increment": ["bool", None],
-		"bantime.factor": ["string", None],
-		"bantime.formula": ["string", None],
-		"bantime.multipliers": ["string", None],
-		"bantime.maxtime": ["string", None],
-		"bantime.rndtime": ["string", None],
-		"bantime.overalljails": ["bool", None],
 		"ignorecommand": ["string", None],
 		"ignoreself": ["bool", None],
 		"ignoreip": ["string", None],
@@ -134,9 +134,8 @@ protocol = [
 ["get <JAIL> ignoreregex", "gets the list of regular expressions which matches patterns to ignore for <JAIL>"],
 ["get <JAIL> findtime", "gets the time for which the filter will look back for failures for <JAIL>"],
 ["get <JAIL> bantime", "gets the time a host is banned for <JAIL>"],
-["get <JAIL> datepattern", "gets the pattern used to match date/times for <JAIL>"],
+["get <JAIL> datepattern", "gets the patern used to match date/times for <JAIL>"],
 ["get <JAIL> usedns", "gets the usedns setting for <JAIL>"],
-["get <JAIL> banip [<SEP>|--with-time]", "gets the list of of banned IP addresses for <JAIL>. Optionally the separator character ('<SEP>', default is space) or the option '--with-time' (printing the times of ban) may be specified. The IPs are ordered by end of ban."],
 ["get <JAIL> maxretry", "gets the number of failures allowed for <JAIL>"],
 ["get <JAIL> maxmatches", "gets the max number of matches stored in memory per ticket in <JAIL>"], 
 ["get <JAIL> maxlines", "gets the number of lines to buffer for <JAIL>"],
@@ -265,10 +265,6 @@ class ActionBase(object):
 		"""
 		return self.ban(aInfo)

-	@property
-	def _prolongable(self): # pragma: no cover - abstract
-		return False
-
 	def unban(self, aInfo): # pragma: no cover - abstract
 		"""Executed when a ban expires.

@@ -281,11 +277,6 @@ class ActionBase(object):
 		pass


-WRAP_CMD_PARAMS = {
-	'timeout': 'str2seconds',
-	'bantime': 'ignore',
-}
-
 class CommandAction(ActionBase):
 	"""A action which executes OS shell commands.

@@ -358,10 +349,7 @@ class CommandAction(ActionBase):
 	def __setattr__(self, name, value):
 		if not name.startswith('_') and not self.__init and not callable(value):
 			# special case for some parameters:
-			wrp = WRAP_CMD_PARAMS.get(name)
-			if wrp == 'ignore': # ignore (filter) dynamic parameters
-				return
-			elif wrp == 'str2seconds':
+			if name in ('timeout', 'bantime'):
 				value = MyTime.str2seconds(value)
 			# parameters changed - clear properties and substitution cache:
 			self.__properties = None
@@ -410,7 +398,7 @@ class CommandAction(ActionBase):
 		cmd = self.replaceTag(tag, self._properties,
 			conditional=('family='+family if family else ''),
 			cache=self.__substCache)
-		if not family or '<' not in cmd: return cmd
+		if '<' not in cmd or not family: return cmd
 		# replace family as dynamic tags, important - don't cache, no recursion and auto-escape here:
 		cmd = self.replaceDynamicTags(cmd, {'family':family})
 		return cmd
@@ -458,18 +446,7 @@ class CommandAction(ActionBase):
 				ret = True
 				# avoid double execution of same command for both families:
 				if cmd and cmd not in self._operationExecuted(tag, lambda f: f != famoper):
-					realCmd = cmd
-					if self._jail:
-						# simulate action info with "empty" ticket:
-						aInfo = getattr(self._jail.actions, 'actionInfo', None)
-						if not aInfo:
-							aInfo = self._jail.actions._getActionInfo(None)
-							setattr(self._jail.actions, 'actionInfo', aInfo)
-						aInfo['time'] = MyTime.time()
-						aInfo['family'] = famoper
-						# replace dynamical tags, important - don't cache, no recursion and auto-escape here
-						realCmd = self.replaceDynamicTags(cmd, aInfo)
-					ret = self.executeCmd(realCmd, self.timeout)
+					ret = self.executeCmd(cmd, self.timeout)
 					res &= ret
 				if afterExec: afterExec(famoper, ret)
 				self._operationExecuted(tag, famoper, cmd if ret else None)
@@ -569,26 +546,6 @@ class CommandAction(ActionBase):
 			raise RuntimeError("Error banning %(ip)s" % aInfo)
 		self.__started[family] = self.__started.get(family, 0) | 3; # started and contains items

-	@property
-	def _prolongable(self):
-		return (hasattr(self, 'actionprolong') and self.actionprolong 
-			and not str(self.actionprolong).isspace())
-	
-	def prolong(self, aInfo):
-		"""Executes the "actionprolong" command.
-
-		Replaces the tags in the action command with actions properties
-		and ban information, and executes the resulting command.
-
-		Parameters
-		----------
-		aInfo : dict
-			Dictionary which includes information in relation to
-			the ban.
-		"""
-		if not self._processCmd('<actionprolong>', aInfo):
-			raise RuntimeError("Error prolonging %(ip)s" % aInfo)
-
 	def unban(self, aInfo):
 		"""Executes the "actionunban" command.

@@ -698,10 +655,8 @@ class CommandAction(ActionBase):
 					ret &= False
 		return ret

-	ESCAPE_CRE = re.compile(r"""[\\#&;`|*?~<>^()\[\]{}$'"\n\r]""")
-	
-	@classmethod
-	def escapeTag(cls, value):
+	@staticmethod
+	def escapeTag(value):
 		"""Escape characters which may be used for command injection.

 		Parameters
@@ -718,15 +673,12 @@ class CommandAction(ActionBase):
 		-----
 		The following characters are escaped::

-			\\#&;`|*?~<>^()[]{}$'"\n\r
+			\\#&;`|*?~<>^()[]{}$'"

 		"""
-		_map2c = {'\n': 'n', '\r': 'r'}
-		def substChar(m):
-			c = m.group()
-			return '\\' + _map2c.get(c, c)
-		
-		value = cls.ESCAPE_CRE.sub(substChar, value)
+		for c in '\\#&;`|*?~<>^()[]{}$\'"':
+			if c in value:
+				value = value.replace(c, '\\' + c)
 		return value

 	@classmethod
@@ -882,7 +834,7 @@ class CommandAction(ActionBase):
 			tickData = aInfo.get("F-*")
 			if not tickData: tickData = {}
 			def substTag(m):
-				tag = mapTag2Opt(m.group(1))
+				tag = mapTag2Opt(m.groups()[0])
 				try:
 					value = uni_string(tickData[tag])
 				except KeyError:
@@ -977,38 +929,31 @@ class CommandAction(ActionBase):
 		except (KeyError, TypeError):
 			family = ''

-		repcnt = 0
-		while True:
-
-			# got some error, do invariant check:
-			if repcnt and self.actioncheck:
-				# don't repair/restore if unban (no matter):
-				def _beforeRepair():
-					if cmd == '<actionunban>' and not self._properties.get('actionrepair_on_unban'):
-						self._logSys.error("Invariant check failed. Unban is impossible.")
-						return False
-					return True
-				# check and repair if broken:
-				ret = self._invariantCheck(family, _beforeRepair, forceStart=(cmd != '<actionunban>'))
-				# if not sane (and not restored) return:
-				if ret != 1:
+		# invariant check:
+		if self.actioncheck:
+			# don't repair/restore if unban (no matter):
+			def _beforeRepair():
+				if cmd == '<actionunban>' and not self._properties.get('actionrepair_on_unban'):
+					self._logSys.error("Invariant check failed. Unban is impossible.")
 					return False
+				return True
+			# check and repair if broken:
+			ret = self._invariantCheck(family, _beforeRepair, forceStart=(cmd != '<actionunban>'))
+			# if not sane (and not restored) return:
+			if ret != 1:
+				return False

-			# Replace static fields
-			realCmd = self.replaceTag(cmd, self._properties, 
-				conditional=('family='+family if family else ''), cache=self.__substCache)
+		# Replace static fields
+		realCmd = self.replaceTag(cmd, self._properties, 
+			conditional=('family='+family if family else ''), cache=self.__substCache)

-			# Replace dynamical tags, important - don't cache, no recursion and auto-escape here
-			if aInfo is not None:
-				realCmd = self.replaceDynamicTags(realCmd, aInfo)
-			else:
-				realCmd = cmd
+		# Replace dynamical tags, important - don't cache, no recursion and auto-escape here
+		if aInfo is not None:
+			realCmd = self.replaceDynamicTags(realCmd, aInfo)
+		else:
+			realCmd = cmd

-			# try execute command:
-			ret = self.executeCmd(realCmd, self.timeout)
-			repcnt += 1
-			if ret or repcnt > 1:
-				return ret
+		return self.executeCmd(realCmd, self.timeout)

 	@staticmethod
 	def executeCmd(realCmd, timeout=60, **kwargs):
@@ -1033,8 +978,7 @@ class CommandAction(ActionBase):
 		RuntimeError
 			If command execution times out.
 		"""
-		if logSys.getEffectiveLevel() < logging.DEBUG:
-			logSys.log(9, realCmd)
+		logSys.debug(realCmd)
 		if not realCmd:
 			logSys.debug("Nothing to do")
 			return True
@@ -42,7 +42,6 @@ from .ipdns import IPAddr
 from .jailthread import JailThread
 from .action import ActionBase, CommandAction, CallingMap
 from .mytime import MyTime
-from .observer import Observers
 from .utils import Utils
 from ..helpers import getLogger

@@ -84,7 +83,7 @@ class Actions(JailThread, Mapping):
 		self._jail = jail
 		self._actions = OrderedDict()
 		## The ban manager.
-		self.banManager = BanManager()
+		self.__banManager = BanManager()
 		self.banEpoch = 0
 		self.__lastConsistencyCheckTM = 0
 		## Precedence of ban (over unban), so max number of tickets banned (to call an unban check):
@@ -203,7 +202,7 @@ class Actions(JailThread, Mapping):
 	
 	def setBanTime(self, value):
 		value = MyTime.str2seconds(value)
-		self.banManager.setBanTime(value)
+		self.__banManager.setBanTime(value)
 		logSys.info("  banTime: %s" % value)
 	
 	##
@@ -212,26 +211,16 @@ class Actions(JailThread, Mapping):
 	# @return the time
 	
 	def getBanTime(self):
-		return self.banManager.getBanTime()
+		return self.__banManager.getBanTime()

 	def getBanned(self, ids):
-		lst = self.banManager.getBanList()
+		lst = self.__banManager.getBanList()
 		if not ids:
 			return lst
 		if len(ids) == 1:
 			return 1 if ids[0] in lst else 0
 		return map(lambda ip: 1 if ip in lst else 0, ids)

-	def getBanList(self, withTime=False):
-		"""Returns the list of banned IP addresses.
-
-		Returns
-		-------
-		list
-			The list of banned IP addresses.
-		"""
-		return self.banManager.getBanList(ordered=True, withTime=withTime)
-
 	def addBannedIP(self, ip):
 		"""Ban an IP or list of IPs."""
 		unixTime = MyTime.time()
@@ -282,7 +271,7 @@ class Actions(JailThread, Mapping):
 		if db and self._jail.database is not None:
 			self._jail.database.delBan(self._jail, ip)
 		# Find the ticket with the IP.
-		ticket = self.banManager.getTicketByID(ip)
+		ticket = self.__banManager.getTicketByID(ip)
 		if ticket is not None:
 			# Unban the IP.
 			self.__unBan(ticket)
@@ -291,7 +280,7 @@ class Actions(JailThread, Mapping):
 			if not isinstance(ip, IPAddr):
 				ipa = IPAddr(ip)
 				if not ipa.isSingle: # subnet (mask/cidr) or raw (may be dns/hostname):
-					ips = filter(ipa.contains, self.banManager.getBanList())
+					ips = filter(ipa.contains, self.__banManager.getBanList())
 					if ips:
 						return self.removeBannedIP(ips, db, ifexists)
 			# not found:
@@ -350,7 +339,7 @@ class Actions(JailThread, Mapping):
 					continue
 				# wait for ban (stop if gets inactive, pending ban or unban):
 				bancnt = 0
-				wt = min(self.sleeptime, self.banManager._nextUnbanTime - MyTime.time())
+				wt = min(self.sleeptime, self.__banManager._nextUnbanTime - MyTime.time())
 				logSys.log(5, "Actions: wait for pending tickets %s (default %s)", wt, self.sleeptime)
 				if Utils.wait_for(lambda: not self.active or self._jail.hasFailTickets, wt):
 					bancnt = self.__checkBan()
@@ -384,8 +373,6 @@ class Actions(JailThread, Mapping):
 			"fid":			lambda self: self.__ticket.getID(),
 			"failures":	lambda self: self.__ticket.getAttempt(),
 			"time":			lambda self: self.__ticket.getTime(),
-			"bantime":  lambda self: self._getBanTime(),
-			"bancount":  lambda self: self.__ticket.getBanCount(),
 			"matches":	lambda self: "\n".join(self.__ticket.getMatches()),
 			# to bypass actions, that should not be executed for restored tickets
 			"restored":	lambda self: (1 if self.__ticket.restored else 0),
@@ -397,12 +384,7 @@ class Actions(JailThread, Mapping):
 			"ipfailures":			lambda self: self._mi4ip(True).getAttempt(),
 			"ipjailfailures":	lambda self: self._mi4ip().getAttempt(),
 			# raw ticket info:
-			"raw-ticket":			lambda self: repr(self.__ticket),
-			# jail info:
-			"jail.banned":       lambda self: self.__jail.actions.banManager.size(),
-			"jail.banned_total": lambda self: self.__jail.actions.banManager.getBanTotal(),
-			"jail.found":        lambda self: self.__jail.filter.failManager.size(),
-			"jail.found_total":  lambda self: self.__jail.filter.failManager.getFailTotal()
+			"raw-ticket":			lambda self: repr(self.__ticket)
 		}

 		__slots__ = CallingMap.__slots__ + ('__ticket', '__jail', '__mi4ip')
@@ -417,11 +399,6 @@ class Actions(JailThread, Mapping):
 		def copy(self): # pragma: no cover
 			return self.__class__(self.__ticket, self.__jail, self.immutable, self.data.copy())

-		def _getBanTime(self):
-			btime = self.__ticket.getBanTime()
-			if btime is None: btime = self.__jail.actions.getBanTime()
-			return int(btime)
-
 		def _mi4ip(self, overalljails=False):
 			"""Gets bans merged once, a helper for lambda(s), prevents stop of executing action by any exception inside.

@@ -465,9 +442,7 @@ class Actions(JailThread, Mapping):
 			return mi[idx] if mi[idx] is not None else self.__ticket


-	def _getActionInfo(self, ticket):
-		if not ticket:
-			ticket = BanTicket("", MyTime.time())
+	def __getActionInfo(self, ticket):
 		aInfo = Actions.ActionInfo(ticket, self._jail)
 		return aInfo

@@ -497,19 +472,13 @@ class Actions(JailThread, Mapping):
 			tickets = self.__getFailTickets(self.banPrecedence)
 		rebanacts = None
 		for ticket in tickets:
-
-			bTicket = BanTicket.wrap(ticket)
-			btime = ticket.getBanTime(self.banManager.getBanTime())
+			bTicket = BanManager.createBanTicket(ticket)
 			ip = bTicket.getIP()
-			aInfo = self._getActionInfo(bTicket)
+			aInfo = self.__getActionInfo(bTicket)
 			reason = {}
-			if self.banManager.addBanTicket(bTicket, reason=reason):
+			if self.__banManager.addBanTicket(bTicket, reason=reason):
 				cnt += 1
-				# report ticket to observer, to check time should be increased and hereafter observer writes ban to database (asynchronous)
-				if Observers.Main is not None and not bTicket.restored:
-					Observers.Main.add('banFound', bTicket, self._jail, btime)
 				logSys.notice("[%s] %sBan %s", self._jail.name, ('' if not bTicket.restored else 'Restore '), ip)
-				# do actions :
 				for name, action in self._actions.iteritems():
 					try:
 						if bTicket.restored and getattr(action, 'norestored', False):
@@ -527,10 +496,7 @@ class Actions(JailThread, Mapping):
 				if self.banEpoch: # be sure tickets always have the same ban epoch (default 0):
 					bTicket.banEpoch = self.banEpoch
 			else:
-				if reason.get('expired', 0):
-					logSys.info('[%s] Ignore %s, expired bantime', self._jail.name, ip)
-					continue
-				bTicket = reason.get('ticket', bTicket)
+				bTicket = reason['ticket']
 				# if already banned (otherwise still process some action)
 				if bTicket.banned:
 					# compare time of failure occurrence with time ticket was really banned:
@@ -558,11 +524,15 @@ class Actions(JailThread, Mapping):
 						cnt += self.__reBan(bTicket, actions=rebanacts)
 				else: # pragma: no cover - unexpected: ticket is not banned for some reasons - reban using all actions:
 					cnt += self.__reBan(bTicket)
-			# add ban to database moved to observer (should previously check not already banned 
-			# and increase ticket time if "bantime.increment" set)
+			# add ban to database:
+			if not bTicket.restored and self._jail.database is not None:
+				# ignore too old (repeated and ignored) tickets,
+				# [todo] replace it with inOperation later (once it gets back-ported):
+				if not reason and bTicket.getTime() >= MyTime.time() - 60:
+					self._jail.database.addBan(self._jail, bTicket)
 		if cnt:
 			logSys.debug("Banned %s / %s, %s ticket(s) in %r", cnt, 
-				self.banManager.getBanTotal(), self.banManager.size(), self._jail.name)
+				self.__banManager.getBanTotal(), self.__banManager.size(), self._jail.name)
 		return cnt

 	def __reBan(self, ticket, actions=None, log=True):
@@ -578,7 +548,7 @@ class Actions(JailThread, Mapping):
 		"""
 		actions = actions or self._actions
 		ip = ticket.getIP()
-		aInfo = self._getActionInfo(ticket)
+		aInfo = self.__getActionInfo(ticket)
 		if log:
 			logSys.notice("[%s] Reban %s%s", self._jail.name, aInfo["ip"], (', action %r' % actions.keys()[0] if len(actions) == 1 else ''))
 		for name, action in actions.iteritems():
@@ -599,41 +569,18 @@ class Actions(JailThread, Mapping):
 			ticket.banEpoch = self.banEpoch
 		return 1

-	def _prolongBan(self, ticket):
-		# prevent to prolong ticket that was removed in-between,
-		# if it in ban list - ban time already prolonged (and it stays there):
-		if not self.banManager._inBanList(ticket): return
-		# do actions :
-		aInfo = None
-		for name, action in self._actions.iteritems():
-			try:
-				if ticket.restored and getattr(action, 'norestored', False):
-					continue
-				if not action._prolongable:
-					continue
-				if aInfo is None:
-					aInfo = self._getActionInfo(ticket)
-				if not aInfo.immutable: aInfo.reset()
-				action.prolong(aInfo)
-			except Exception as e:
-				logSys.error(
-					"Failed to execute ban jail '%s' action '%s' "
-					"info '%r': %s",
-					self._jail.name, name, aInfo, e,
-					exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
-
 	def __checkUnBan(self, maxCount=None):
 		"""Check for IP address to unban.

 		Unban IP addresses which are outdated.
 		"""
-		lst = self.banManager.unBanList(MyTime.time(), maxCount)
+		lst = self.__banManager.unBanList(MyTime.time(), maxCount)
 		for ticket in lst:
 			self.__unBan(ticket)
 		cnt = len(lst)
 		if cnt:
 			logSys.debug("Unbanned %s, %s ticket(s) in %r", 
-				cnt, self.banManager.size(), self._jail.name)
+				cnt, self.__banManager.size(), self._jail.name)
 		return cnt

 	def __flushBan(self, db=False, actions=None, stop=False):
@@ -647,10 +594,10 @@ class Actions(JailThread, Mapping):
 		log = True
 		if actions is None:
 			logSys.debug("  Flush ban list")
-			lst = self.banManager.flushBanList()
+			lst = self.__banManager.flushBanList()
 		else:
 			log = False # don't log "[jail] Unban ..." if removing actions only.
-			lst = iter(self.banManager)
+			lst = iter(self.__banManager)
 		cnt = 0
 		# first we'll execute flush for actions supporting this operation:
 		unbactions = {}
@@ -687,7 +634,7 @@ class Actions(JailThread, Mapping):
 			self.__unBan(ticket, actions=actions, log=log)
 			cnt += 1
 		logSys.debug("  Unbanned %s, %s ticket(s) in %r", 
-			cnt, self.banManager.size(), self._jail.name)
+			cnt, self.__banManager.size(), self._jail.name)
 		return cnt

 	def __unBan(self, ticket, actions=None, log=True):
@@ -706,7 +653,7 @@ class Actions(JailThread, Mapping):
 		else:
 			unbactions = actions
 		ip = ticket.getIP()
-		aInfo = self._getActionInfo(ticket)
+		aInfo = self.__getActionInfo(ticket)
 		if log:
 			logSys.notice("[%s] Unban %s", self._jail.name, aInfo["ip"])
 		for name, action in unbactions.iteritems():
@@ -730,18 +677,18 @@ class Actions(JailThread, Mapping):
 			logSys.warning("Unsupported extended jail status flavor %r. Supported: %s" % (flavor, supported_flavors))
 		# Always print this information (basic)
 		if flavor != "short":
-			banned = self.banManager.getBanList()
+			banned = self.__banManager.getBanList()
 			cnt = len(banned)
 		else:
-			cnt = self.banManager.size()
+			cnt = self.__banManager.size()
 		ret = [("Currently banned", cnt),
-			   ("Total banned", self.banManager.getBanTotal())]
+			   ("Total banned", self.__banManager.getBanTotal())]
 		if flavor != "short":
 			ret += [("Banned IP list", banned)]
 		if flavor == "cymru":
-			cymru_info = self.banManager.getBanListExtendedCymruInfo()
+			cymru_info = self.__banManager.getBanListExtendedCymruInfo()
 			ret += \
-				[("Banned ASN list", self.banManager.geBanListExtendedASN(cymru_info)),
-				 ("Banned Country list", self.banManager.geBanListExtendedCountry(cymru_info)),
-				 ("Banned RIR list", self.banManager.geBanListExtendedRIR(cymru_info))]
+				[("Banned ASN list", self.__banManager.geBanListExtendedASN(cymru_info)),
+				 ("Banned Country list", self.__banManager.geBanListExtendedCountry(cymru_info)),
+				 ("Banned RIR list", self.__banManager.geBanListExtendedRIR(cymru_info))]
 		return ret
@@ -66,7 +66,7 @@ class BanManager:
 	# @param value the time
 	
 	def setBanTime(self, value):
-			self.__banTime = int(value)
+		self.__banTime = int(value)
 	
 	##
 	# Get the ban time.
@@ -75,7 +75,7 @@ class BanManager:
 	# @return the time
 	
 	def getBanTime(self):
-			return self.__banTime
+		return self.__banTime
 	
 	##
 	# Set the total number of banned address.
@@ -83,7 +83,7 @@ class BanManager:
 	# @param value total number
 	
 	def setBanTotal(self, value):
-			self.__banTotal = value
+		self.__banTotal = value
 	
 	##
 	# Get the total number of banned address.
@@ -91,29 +91,15 @@ class BanManager:
 	# @return the total number
 	
 	def getBanTotal(self):
-			return self.__banTotal
+		return self.__banTotal

 	##
 	# Returns a copy of the IP list.
 	#
 	# @return IP list
 	
-	def getBanList(self, ordered=False, withTime=False):
-		if not ordered:
-			return list(self.__banList.keys())
-		with self.__lock:
-			lst = []
-			for ticket in self.__banList.itervalues():
-				eob = ticket.getEndOfBanTime(self.__banTime)
-				lst.append((ticket,eob))
-		lst.sort(key=lambda t: t[1])
-		t2s = MyTime.time2str
-		if withTime:
-			return ['%s \t%s + %d = %s' % (
-					t[0].getID(), 
-					t2s(t[0].getTime()), t[0].getBanTime(self.__banTime), t2s(t[1])
-				) for t in lst]
-		return [t[0].getID() for t in lst]
+	def getBanList(self):
+		return list(self.__banList.keys())

 	##
 	# Returns a iterator to ban list (used in reload, so idle).
@@ -122,7 +108,7 @@ class BanManager:
 	
 	def __iter__(self):
 		# ensure iterator is safe - traverse over the list in snapshot created within lock (GIL):
-			return iter(list(self.__banList.values()))
+		return iter(list(self.__banList.values()))

 	##
 	# Returns normalized value
@@ -258,6 +244,21 @@ class BanManager:
 			logSys.exception(e)
 			return []

+	##
+	# Create a ban ticket.
+	#
+	# Create a BanTicket from a FailTicket. The timestamp of the BanTicket
+	# is the current time. This is a static method.
+	# @param ticket the FailTicket
+	# @return a BanTicket
+	
+	@staticmethod
+	def createBanTicket(ticket):
+		# we should always use correct time to calculate correct end time (ban time is variable now, 
+		# + possible double banning by restore from database and from log file)
+		# so use as lastTime always time from ticket.
+		return BanTicket(ticket=ticket)
+	
 	##
 	# Add a ban ticket.
 	#
@@ -267,9 +268,6 @@ class BanManager:
 	
 	def addBanTicket(self, ticket, reason={}):
 		eob = ticket.getEndOfBanTime(self.__banTime)
-		if eob < MyTime.time():
-			reason['expired'] = 1
-			return False
 		with self.__lock:
 			# check already banned
 			fid = ticket.getID()
@@ -291,7 +289,6 @@ class BanManager:
 			# not yet banned - add new one:
 			self.__banList[fid] = ticket
 			self.__banTotal += 1
-			ticket.incrBanCount()
 			# correct next unban time:
 			if self._nextUnbanTime > eob:
 				self._nextUnbanTime = eob
@@ -138,7 +138,7 @@ class Fail2BanDb(object):
 	filename
 	purgeage
 	"""
-	__version__ = 4
+	__version__ = 2
 	# Note all SCRIPTS strings must end in ';' for py26 compatibility
 	_CREATE_SCRIPTS = (
 		 ('fail2banDb', "CREATE TABLE IF NOT EXISTS fail2banDb(version INTEGER);")
@@ -166,36 +166,21 @@ class Fail2BanDb(object):
 			"jail TEXT NOT NULL, " \
 			"ip TEXT, " \
 			"timeofban INTEGER NOT NULL, " \
-			"bantime INTEGER NOT NULL, " \
-			"bancount INTEGER NOT NULL default 1, " \
 			"data JSON, " \
 			"FOREIGN KEY(jail) REFERENCES jails(name) " \
 			");" \
 			"CREATE INDEX IF NOT EXISTS bans_jail_timeofban_ip ON bans(jail, timeofban);" \
 			"CREATE INDEX IF NOT EXISTS bans_jail_ip ON bans(jail, ip);" \
 			"CREATE INDEX IF NOT EXISTS bans_ip ON bans(ip);")
-		,('bips', "CREATE TABLE IF NOT EXISTS bips(" \
-			"ip TEXT NOT NULL, " \
-			"jail TEXT NOT NULL, " \
-			"timeofban INTEGER NOT NULL, " \
-			"bantime INTEGER NOT NULL, " \
-			"bancount INTEGER NOT NULL default 1, " \
-			"data JSON, " \
-			"PRIMARY KEY(ip, jail), " \
-			"FOREIGN KEY(jail) REFERENCES jails(name) " \
-			");" \
-			"CREATE INDEX IF NOT EXISTS bips_timeofban ON bips(timeofban);" \
-			"CREATE INDEX IF NOT EXISTS bips_ip ON bips(ip);")
 	)
 	_CREATE_TABS = dict(_CREATE_SCRIPTS)


-	def __init__(self, filename, purgeAge=24*60*60, outDatedFactor=3):
+	def __init__(self, filename, purgeAge=24*60*60):
 		self.maxMatches = 10
 		self._lock = RLock()
 		self._dbFilename = filename
 		self._purgeAge = purgeAge
-		self._outDatedFactor = outDatedFactor;
 		self._connectDB()

 	def _connectDB(self, checkIntegrity=False):
@@ -381,32 +366,13 @@ class Fail2BanDb(object):

 			if version < 2 and self._tableExists(cur, "logs"):
 				cur.executescript("BEGIN TRANSACTION;"
-							"CREATE TEMPORARY TABLE logs_temp AS SELECT * FROM logs;"
-							"DROP TABLE logs;"
-							"%s;"
-							"INSERT INTO logs SELECT * from logs_temp;"
-							"DROP TABLE logs_temp;"
-							"UPDATE fail2banDb SET version = 2;"
-							"COMMIT;" % Fail2BanDb._CREATE_TABS['logs'])
-
-			if version < 3 and self._tableExists(cur, "bans"):
-				# set ban-time to -2 (note it means rather unknown, as persistent, will be fixed by restore):
-				cur.executescript("BEGIN TRANSACTION;"
-							"CREATE TEMPORARY TABLE bans_temp AS SELECT jail, ip, timeofban, -2 as bantime, 1 as bancount, data FROM bans;"
-							"DROP TABLE bans;"
-							"%s;\n"
-							"INSERT INTO bans SELECT * from bans_temp;"
-							"DROP TABLE bans_temp;"
-							"COMMIT;" % Fail2BanDb._CREATE_TABS['bans'])
-			if version < 4 and not self._tableExists(cur, "bips"):
-				cur.executescript("BEGIN TRANSACTION;"
-							"%s;\n"
-							"UPDATE fail2banDb SET version = 4;"
-							"COMMIT;" % Fail2BanDb._CREATE_TABS['bips'])
-				if self._tableExists(cur, "bans"):
-					cur.execute(
-							"INSERT OR REPLACE INTO bips(ip, jail, timeofban, bantime, bancount, data)"
-							"  SELECT ip, jail, timeofban, bantime, bancount, data FROM bans order by timeofban")
+						"CREATE TEMPORARY TABLE logs_temp AS SELECT * FROM logs;"
+						"DROP TABLE logs;"
+						"%s;"
+						"INSERT INTO logs SELECT * from logs_temp;"
+						"DROP TABLE logs_temp;"
+						"UPDATE fail2banDb SET version = 2;"
+						"COMMIT;" % Fail2BanDb._CREATE_TABS['logs'])

 			cur.execute("SELECT version FROM fail2banDb LIMIT 1")
 			return cur.fetchone()[0]
@@ -502,7 +468,7 @@ class Fail2BanDb(object):
 		except TypeError:
 			firstLineMD5 = None

-		if firstLineMD5 is None and (pos or md5 is not None):
+		if not firstLineMD5 and (pos or md5):
 			cur.execute(
 					"INSERT OR REPLACE INTO logs(jail, path, firstlinemd5, lastfilepos) "
 						"VALUES(?, ?, ?, ?)", (jail.name, name, md5, pos))
@@ -619,13 +585,8 @@ class Fail2BanDb(object):
 			data = data.copy()
 			del data['matches']
 		cur.execute(
-			"INSERT INTO bans(jail, ip, timeofban, bantime, bancount, data) VALUES(?, ?, ?, ?, ?, ?)",
-			(jail.name, ip, int(round(ticket.getTime())), ticket.getBanTime(jail.actions.getBanTime()), ticket.getBanCount(),
-				data))
-		cur.execute(
-			"INSERT OR REPLACE INTO bips(ip, jail, timeofban, bantime, bancount, data) VALUES(?, ?, ?, ?, ?, ?)",
-			(ip, jail.name, int(round(ticket.getTime())), ticket.getBanTime(jail.actions.getBanTime()), ticket.getBanCount(),
-				data))
+			"INSERT INTO bans(jail, ip, timeofban, data) VALUES(?, ?, ?, ?)",
+			(jail.name, ip, int(round(ticket.getTime())), data))

 	@commitandrollback
 	def delBan(self, cur, jail, *args):
@@ -638,20 +599,16 @@ class Fail2BanDb(object):
 		args : list of IP
 			IPs to be removed, if not given all tickets of jail will be removed.
 		"""
-		query1 = "DELETE FROM bips WHERE jail = ?"
-		query2 = "DELETE FROM bans WHERE jail = ?"
+		query = "DELETE FROM bans WHERE jail = ?"
 		queryArgs = [jail.name];
 		if not len(args):
-			cur.execute(query1, queryArgs);
-			cur.execute(query2, queryArgs);
+			cur.execute(query, queryArgs);
 			return
-		query1 += " AND ip = ?"
-		query2 += " AND ip = ?"
+		query += " AND ip = ?"
 		queryArgs.append('');
 		for ip in args:
 			queryArgs[1] = str(ip);
-			cur.execute(query1, queryArgs);
-			cur.execute(query2, queryArgs);
+			cur.execute(query, queryArgs);

 	@commitandrollback
 	def _getBans(self, cur, jail=None, bantime=None, ip=None):
@@ -769,42 +726,18 @@ class Fail2BanDb(object):
 				self._bansMergedCache[cacheKey] = tickets if ip is None else ticket
 			return tickets if ip is None else ticket

-	@commitandrollback
-	def getBan(self, cur, ip, jail=None, forbantime=None, overalljails=None, fromtime=None):
-		ip = str(ip)
-		if not overalljails:
-			query = "SELECT bancount, timeofban, bantime FROM bips"
-		else:
-			query = "SELECT sum(bancount), max(timeofban), sum(bantime) FROM bips"
-		query += " WHERE ip = ?"
-		queryArgs = [ip]
-		if not overalljails and jail is not None:
-			query += " AND jail=?"
-			queryArgs.append(jail.name)
-		if forbantime is not None:
-			query += " AND timeofban > ?"
-			queryArgs.append(MyTime.time() - forbantime)
-		if fromtime is not None:
-			query += " AND timeofban > ?"
-			queryArgs.append(fromtime)
-		if overalljails or jail is None:
-			query += " GROUP BY ip ORDER BY timeofban DESC LIMIT 1"
-		cur = self._db.cursor()
-		# repack iterator as long as in lock:
-		return list(cur.execute(query, queryArgs))
-
 	def _getCurrentBans(self, cur, jail = None, ip = None, forbantime=None, fromtime=None):
+		if fromtime is None:
+			fromtime = MyTime.time()
 		queryArgs = []
 		if jail is not None:
-			query = "SELECT ip, timeofban, bantime, bancount, data FROM bips WHERE jail=?"
+			query = "SELECT ip, timeofban, data FROM bans WHERE jail=?"
 			queryArgs.append(jail.name)
 		else:
-			query = "SELECT ip, max(timeofban), bantime, bancount, data FROM bips WHERE 1"
+			query = "SELECT ip, max(timeofban), data FROM bans WHERE 1"
 		if ip is not None:
 			query += " AND ip=?"
 			queryArgs.append(ip)
-		query += " AND (timeofban + bantime > ? OR bantime <= -1)"
-		queryArgs.append(fromtime)
 		if forbantime not in (None, -1): # not specified or persistent (all)
 			query += " AND timeofban > ?"
 			queryArgs.append(fromtime - forbantime)
@@ -815,90 +748,33 @@ class Fail2BanDb(object):
 		cur = self._db.cursor()
 		return cur.execute(query, queryArgs)

-	@commitandrollback
-	def getCurrentBans(self, cur, jail=None, ip=None, forbantime=None, fromtime=None,
-		correctBanTime=True, maxmatches=None
-	):
-		"""Reads tickets (with merged info) currently affected from ban from the database.
-		
-		There are all the tickets corresponding parameters jail/ip, forbantime,
-		fromtime (normally now).
-		
-		If correctBanTime specified (default True) it will fix the restored ban-time 
-		(and therefore endOfBan) of the ticket (normally it is ban-time of jail as maximum)
-		for all tickets with ban-time greater (or persistent).
-		"""
-		if fromtime is None:
-			fromtime = MyTime.time()
+	def getCurrentBans(self, jail = None, ip = None, forbantime=None, fromtime=None, maxmatches=None):
 		tickets = []
 		ticket = None
-		if correctBanTime is True:
-			correctBanTime = jail.getMaxBanTime() if jail is not None else None
-			# don't change if persistent allowed:
-			if correctBanTime == -1: correctBanTime = None

-		for ticket in self._getCurrentBans(cur, jail=jail, ip=ip, 
-			forbantime=forbantime, fromtime=fromtime
-		):
-			# can produce unpack error (database may return sporadical wrong-empty row):
-			try:
-				banip, timeofban, bantime, bancount, data = ticket
-				# additionally check for empty values:
-				if banip is None or banip == "": # pragma: no cover
-					raise ValueError('unexpected value %r' % (banip,))
-				# if bantime unknown (after upgrade-db from earlier version), just use min known ban-time:
-				if bantime == -2: # todo: remove it in future version
-					bantime = jail.actions.getBanTime() if jail is not None else (
-						correctBanTime if correctBanTime else 600)
-				elif correctBanTime and correctBanTime >= 0:
-					# if persistent ban (or greater as max), use current max-bantime of the jail:
-					if bantime == -1 or bantime > correctBanTime:
-						bantime = correctBanTime
-				# after correction check the end of ban again:
-				if bantime != -1 and timeofban + bantime <= fromtime:
-					# not persistent and too old - ignore it:
-					logSys.debug("ignore ticket (with new max ban-time %r): too old %r <= %r, ticket: %r",
-						bantime, timeofban + bantime, fromtime, ticket)
-					continue
-			except ValueError as e: # pragma: no cover
-				logSys.debug("get current bans: ignore row %r - %s", ticket, e)
-				continue
-			# logSys.debug('restore ticket   %r, %r, %r', banip, timeofban, data)
-			ticket = FailTicket(banip, timeofban, data=data)
-			# filter matches if expected (current count > as maxmatches specified):
-			if maxmatches is None:
-				maxmatches = self.maxMatches
-			if maxmatches:
-				matches = ticket.getMatches()
-				if matches and len(matches) > maxmatches:
-					ticket.setMatches(matches[-maxmatches:])
-			else:
-				ticket.setMatches(None)
-			# logSys.debug('restored ticket: %r', ticket)
-			ticket.setBanTime(bantime)
-			ticket.setBanCount(bancount)
-			if ip is not None: return ticket
-			tickets.append(ticket)
+		with self._lock:
+			results = list(self._getCurrentBans(self._db.cursor(), 
+				jail=jail, ip=ip, forbantime=forbantime, fromtime=fromtime))
+
+		if results:
+			for banip, timeofban, data in results:
+				# logSys.debug('restore ticket   %r, %r, %r', banip, timeofban, data)
+				ticket = FailTicket(banip, timeofban, data=data)
+				# filter matches if expected (current count > as maxmatches specified):
+				if maxmatches is None:
+					maxmatches = self.maxMatches
+				if maxmatches:
+					matches = ticket.getMatches()
+					if matches and len(matches) > maxmatches:
+						ticket.setMatches(matches[-maxmatches:])
+				else:
+					ticket.setMatches(None)
+				# logSys.debug('restored ticket: %r', ticket)
+				if ip is not None: return ticket
+				tickets.append(ticket)

 		return tickets

-	def _cleanjails(self, cur):
-		"""Remove empty jails jails and log files from database.
-		"""
-		cur.execute(
-			"DELETE FROM jails WHERE enabled = 0 "
-				"AND NOT EXISTS(SELECT * FROM bans WHERE jail = jails.name) "
-				"AND NOT EXISTS(SELECT * FROM bips WHERE jail = jails.name)")
-
-	def _purge_bips(self, cur):
-		"""Purge old bad ips (jails and log files from database).
-		Currently it is timed out IP, whose time since last ban is several times out-dated (outDatedFactor is default 3).
-		Permanent banned ips will be never removed.
-		"""
-		cur.execute(
-			"DELETE FROM bips WHERE timeofban < ? and bantime != -1 and (timeofban + (bantime * ?)) < ?",
-			(int(MyTime.time()) - self._purgeAge, self._outDatedFactor, int(MyTime.time()) - self._purgeAge))
-
 	@commitandrollback
 	def purge(self, cur):
 		"""Purge old bans, jails and log files from database.
@@ -907,6 +783,7 @@ class Fail2BanDb(object):
 		cur.execute(
 			"DELETE FROM bans WHERE timeofban < ?",
 			(MyTime.time() - self._purgeAge, ))
-		self._purge_bips(cur)
-		self._cleanjails(cur)
+		cur.execute(
+			"DELETE FROM jails WHERE enabled = 0 "
+				"AND NOT EXISTS(SELECT * FROM bans WHERE jail = jails.name)")

@@ -27,7 +27,7 @@ __license__ = "GPL"
 from threading import Lock
 import logging

-from .ticket import FailTicket, BanTicket
+from .ticket import FailTicket
 from ..helpers import getLogger, BgService

 # Gets the instance of the logger.
@@ -69,7 +69,7 @@ class FailManager:
 	def getMaxTime(self):
 		return self.__maxTime

-	def addFailure(self, ticket, count=1, observed=False):
+	def addFailure(self, ticket, count=1):
 		attempts = 1
 		with self.__lock:
 			fid = ticket.getID()
@@ -96,14 +96,11 @@ class FailManager:
 				else:
 					fData.setMatches(None)
 			except KeyError:
-				# not found - already banned - prevent to add failure if comes from observer:
-				if observed or isinstance(ticket, BanTicket):
-					return ticket.getRetry()
 				# if already FailTicket - add it direct, otherwise create (using copy all ticket data):
 				if isinstance(ticket, FailTicket):
 					fData = ticket;
 				else:
-					fData = FailTicket.wrap(ticket)
+					fData = FailTicket(ticket=ticket)
 				if count > ticket.getAttempt():
 					fData.setRetry(count)
 				self.__failList[fid] = fData
@@ -87,24 +87,20 @@ RH4TAG = {

 # default failure groups map for customizable expressions (with different group-id):
 R_MAP = {
-	"id": "fid",
-	"port": "fport",
+	"ID": "fid",
+	"PORT": "fport",
 }

 def mapTag2Opt(tag):
-	tag = tag.lower()
-	return R_MAP.get(tag, tag)
+	try: # if should be mapped:
+		return R_MAP[tag]
+	except KeyError:
+		return tag.lower()


-# complex names:
-# ALT_   - alternate names to be merged, e. g. alt_user_1 -> user ...
+# alternate names to be merged, e. g. alt_user_1 -> user ...
 ALTNAME_PRE = 'alt_'
-# TUPLE_ - names of parts to be combined to single value as tuple
-TUPNAME_PRE = 'tuple_'
-
-COMPLNAME_PRE = (ALTNAME_PRE, TUPNAME_PRE)
-COMPLNAME_CRE = re.compile(r'^(' + '|'.join(COMPLNAME_PRE) + r')(.*?)(?:_\d+)?$')
-
+ALTNAME_CRE = re.compile(r'^' + ALTNAME_PRE + r'(.*)(?:_\d+)?$')

 ##
 # Regular expression class.
@@ -131,27 +127,19 @@ class Regex:
 		try:
 			self._regexObj = re.compile(regex, re.MULTILINE if multiline else 0)
 			self._regex = regex
-			self._altValues = []
-			self._tupleValues = []
+			self._altValues = {}
 			for k in filter(
-				lambda k: len(k) > len(COMPLNAME_PRE[0]), self._regexObj.groupindex
+				lambda k: len(k) > len(ALTNAME_PRE) and k.startswith(ALTNAME_PRE),
+				self._regexObj.groupindex
 			):
-				n = COMPLNAME_CRE.match(k)
-				if n:
-					g, n = n.group(1), mapTag2Opt(n.group(2))
-					if g == ALTNAME_PRE:
-						self._altValues.append((k,n))
-					else:
-						self._tupleValues.append((k,n))
-			self._altValues.sort()
-			self._tupleValues.sort()
-			self._altValues = self._altValues if len(self._altValues) else None
-			self._tupleValues = self._tupleValues if len(self._tupleValues) else None
+				n = ALTNAME_CRE.match(k).group(1)
+				self._altValues[k] = n
+			self._altValues = list(self._altValues.items()) if len(self._altValues) else None
 		except sre_constants.error:
 			raise RegexException("Unable to compile regular expression '%s'" %
 								 regex)
-		# set fetch handler depending on presence of alternate (or tuple) tags:
-		self.getGroups = self._getGroupsWithAlt if (self._altValues or self._tupleValues) else self._getGroups
+		# set fetch handler depending on presence of alternate tags:
+		self.getGroups = self._getGroupsWithAlt if self._altValues else self._getGroups

 	def __str__(self):
 		return "%s(%r)" % (self.__class__.__name__, self._regex)
@@ -296,23 +284,12 @@ class Regex:

 	def _getGroupsWithAlt(self):
 		fail = self._matchCache.groupdict()
-		#fail = fail.copy()
 		# merge alternate values (e. g. 'alt_user_1' -> 'user' or 'alt_host' -> 'host'):
-		if self._altValues:
-			for k,n in self._altValues:
-				v = fail.get(k)
-				if v and not fail.get(n):
-					fail[n] = v
-		# combine tuple values (e. g. 'id', 'tuple_id' ... 'tuple_id_N' -> 'id'):
-		if self._tupleValues:
-			for k,n in self._tupleValues:
-				v = fail.get(k)
-				t = fail.get(n)
-				if isinstance(t, tuple):
-					t += (v,)
-				else:
-					t = (t,v,)
-				fail[n] = t
+		#fail = fail.copy()
+		for k,n in self._altValues:
+			v = fail.get(k)
+			if v and not fail.get(n):
+				fail[n] = v
 		return fail

 	def getGroups(self): # pragma: no cover - abstract function (replaced in __init__)
@@ -33,7 +33,6 @@ import time
 from .actions import Actions
 from .failmanager import FailManagerEmpty, FailManager
 from .ipdns import DNSUtils, IPAddr
-from .observer import Observers
 from .ticket import FailTicket
 from .jailthread import JailThread
 from .datedetector import DateDetector, validateTimeZone
@@ -715,16 +714,13 @@ class Filter(JailThread):
 				if self._inIgnoreIPList(ip, tick):
 					continue
 				logSys.info(
-					"[%s] Found %s - %s", self.jailName, ip, MyTime.time2str(unixTime)
+					"[%s] Found %s - %s", self.jailName, ip, datetime.datetime.fromtimestamp(unixTime).strftime("%Y-%m-%d %H:%M:%S")
 				)
 				attempts = self.failManager.addFailure(tick)
 				# avoid RC on busy filter (too many failures) - if attempts for IP/ID reached maxretry,
 				# we can speedup ban, so do it as soon as possible:
 				if attempts >= self.failManager.getMaxRetry():
 					self.performBan(ip)
-				# report to observer - failure was found, for possibly increasing of it retry counter (asynchronous)
-				if Observers.Main is not None:
-					Observers.Main.add('failureFound', self.failManager, self.jail, tick)
 			self.procLines += 1
 			# every 100 lines check need to perform service tasks:
 			if self.procLines % 100 == 0:
@@ -1140,14 +1136,14 @@ class FileFilter(Filter):
 				while not self.idle:
 					line = log.readline()
 					if not self.active: break; # jail has been stopped
-					if line is None:
+					if not line:
 						# The jail reached the bottom, simply set in operation for this log
 						# (since we are first time at end of file, growing is only possible after modifications):
 						log.inOperation = True
 						break
 					# acquire in operation from log and process:
 					self.inOperation = inOperation if inOperation is not None else log.inOperation
-					self.processLineAndAdd(line)
+					self.processLineAndAdd(line.rstrip('\r\n'))
 		finally:
 			log.close()
 		if self.jail.database is not None:
@@ -1169,9 +1165,7 @@ class FileFilter(Filter):
 		fs = container.getFileSize()
 		if logSys.getEffectiveLevel() <= logging.DEBUG:
 			logSys.debug("Seek to find time %s (%s), file size %s", date, 
-				MyTime.time2str(date), fs)
-		if not fs:
-			return
+				datetime.datetime.fromtimestamp(date).strftime("%Y-%m-%d %H:%M:%S"), fs)
 		minp = container.getPos()
 		maxp = fs
 		tryPos = minp
@@ -1195,8 +1189,8 @@ class FileFilter(Filter):
 			dateTimeMatch = None
 			nextp = None
 			while True:
-				line = container.readline(False)
-				if line is None:
+				line = container.readline()
+				if not line:
 					break
 				(timeMatch, template) = self.dateDetector.matchTime(line)
 				if timeMatch:
@@ -1250,7 +1244,7 @@ class FileFilter(Filter):
 		container.setPos(foundPos)
 		if logSys.getEffectiveLevel() <= logging.DEBUG:
 			logSys.debug("Position %s from %s, found time %s (%s) within %s seeks", lastPos, fs, foundTime, 
-				(MyTime.time2str(foundTime) if foundTime is not None else ''), cntr)
+				(datetime.datetime.fromtimestamp(foundTime).strftime("%Y-%m-%d %H:%M:%S") if foundTime is not None else ''), cntr)
 		
 	def status(self, flavor="basic"):
 		"""Status of Filter plus files being monitored.
@@ -1314,34 +1308,25 @@ except ImportError: # pragma: no cover

 class FileContainer:

-	def __init__(self, filename, encoding, tail=False, doOpen=False):
+	def __init__(self, filename, encoding, tail=False):
 		self.__filename = filename
-		self.waitForLineEnd = True
 		self.setEncoding(encoding)
 		self.__tail = tail
 		self.__handler = None
-		self.__pos = 0
-		self.__pos4hash = 0
-		self.__hash = ''
-		self.__hashNextTime = time.time() + 30
 		# Try to open the file. Raises an exception if an error occurred.
 		handler = open(filename, 'rb')
-		if doOpen: # fail2ban-regex only (don't need to reopen it and check for rotation)
-			self.__handler = handler
-			return
+		stats = os.fstat(handler.fileno())
+		self.__ino = stats.st_ino
 		try:
-			stats = os.fstat(handler.fileno())
-			self.__ino = stats.st_ino
-			if stats.st_size:
-				firstLine = handler.readline()
-				# first line available and contains new-line:
-				if firstLine != firstLine.rstrip(b'\r\n'):
-					# Computes the MD5 of the first line.
-					self.__hash = md5sum(firstLine).hexdigest()
-				# if tail mode scroll to the end of file
-				if tail:
-					handler.seek(0, 2)
-					self.__pos = handler.tell()
+			firstLine = handler.readline()
+			# Computes the MD5 of the first line.
+			self.__hash = md5sum(firstLine).hexdigest()
+			# Start at the beginning of file if tail mode is off.
+			if tail:
+				handler.seek(0, 2)
+				self.__pos = handler.tell()
+			else:
+				self.__pos = 0
 		finally:
 			handler.close()
 		## shows that log is in operation mode (expecting new messages only from here):
@@ -1360,10 +1345,6 @@ class FileContainer:
 		return self.__filename

 	def getFileSize(self):
-		h = self.__handler
-		if h is not None:
-			stats = os.fstat(h.fileno())
-			return stats.st_size
 		return os.path.getsize(self.__filename);

 	def setEncoding(self, encoding):
@@ -1382,54 +1363,38 @@ class FileContainer:
 	def setPos(self, value):
 		self.__pos = value

-	def open(self, forcePos=None):
-		h = open(self.__filename, 'rb')
-		try:
-			# Set the file descriptor to be FD_CLOEXEC
-			fd = h.fileno()
-			flags = fcntl.fcntl(fd, fcntl.F_GETFD)
-			fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
-			myHash = self.__hash
-			# Stat the file before even attempting to read it
-			stats = os.fstat(h.fileno())
-			rotflg = stats.st_size < self.__pos or stats.st_ino != self.__ino
-			if rotflg or not len(myHash) or time.time() > self.__hashNextTime:
-				myHash = ''
-				firstLine = h.readline()
-				# Computes the MD5 of the first line (if it is complete)
-				if firstLine != firstLine.rstrip(b'\r\n'):
-					myHash = md5sum(firstLine).hexdigest()
-					self.__hashNextTime = time.time() + 30
-			elif stats.st_size == self.__pos:
-				myHash = self.__hash
-			# Compare size, hash and inode
-			if rotflg or myHash != self.__hash:
-				if self.__hash != '':
-					logSys.log(logging.MSG, "Log rotation detected for %s, reason: %r", self.__filename,
-						(stats.st_size, self.__pos, stats.st_ino, self.__ino, myHash, self.__hash))
-					self.__ino = stats.st_ino
-					self.__pos = 0
-				self.__hash = myHash
-			# if nothing to read from file yet (empty or no new data):
-			if forcePos is not None:
-				self.__pos = forcePos
-			elif stats.st_size <= self.__pos:
-				return False
-			# Sets the file pointer to the last position.
-			h.seek(self.__pos)
-			# leave file open (to read content):
-			self.__handler = h; h = None
-		finally:
-			# close (no content or error only)
-			if h:
-				h.close(); h = None
+	def open(self):
+		self.__handler = open(self.__filename, 'rb')
+		# Set the file descriptor to be FD_CLOEXEC
+		fd = self.__handler.fileno()
+		flags = fcntl.fcntl(fd, fcntl.F_GETFD)
+		fcntl.fcntl(fd, fcntl.F_SETFD, flags | fcntl.FD_CLOEXEC)
+		# Stat the file before even attempting to read it
+		stats = os.fstat(self.__handler.fileno())
+		if not stats.st_size:
+			# yoh: so it is still an empty file -- nothing should be
+			#      read from it yet
+			# print "D: no content -- return"
+			return False
+		firstLine = self.__handler.readline()
+		# Computes the MD5 of the first line.
+		myHash = md5sum(firstLine).hexdigest()
+		## print "D: fn=%s hashes=%s/%s inos=%s/%s pos=%s rotate=%s" % (
+		## 	self.__filename, self.__hash, myHash, stats.st_ino, self.__ino, self.__pos,
+		## 	self.__hash != myHash or self.__ino != stats.st_ino)
+		## sys.stdout.flush()
+		# Compare hash and inode
+		if self.__hash != myHash or self.__ino != stats.st_ino:
+			logSys.log(logging.MSG, "Log rotation detected for %s", self.__filename)
+			self.__hash = myHash
+			self.__ino = stats.st_ino
+			self.__pos = 0
+		# Sets the file pointer to the last position.
+		self.__handler.seek(self.__pos)
 		return True

 	def seek(self, offs, endLine=True):
 		h = self.__handler
-		if h is None:
-			self.open(offs)
-			h = self.__handler
 		# seek to given position
 		h.seek(offs, 0)
 		# goto end of next line
@@ -1447,9 +1412,6 @@ class FileContainer:
 		try:
 			return line.decode(enc, 'strict')
 		except (UnicodeDecodeError, UnicodeEncodeError) as e:
-			# avoid warning if got incomplete end of line (e. g. '\n' in "...[0A" followed by "00]..." for utf-16le:
-			if (e.end == len(line) and line[e.start] in b'\r\n'):
-				return line[0:e.start].decode(enc, 'replace')
 			global _decode_line_warn
 			lev = 7
 			if not _decode_line_warn.get(filename, 0):
@@ -1458,85 +1420,29 @@ class FileContainer:
 			logSys.log(lev,
 				"Error decoding line from '%s' with '%s'.", filename, enc)
 			if logSys.getEffectiveLevel() <= lev:
-				logSys.log(lev,
-					"Consider setting logencoding to appropriate encoding for this jail. "
-					"Continuing to process line ignoring invalid characters: %r",
+				logSys.log(lev, "Consider setting logencoding=utf-8 (or another appropriate"
+					" encoding) for this jail. Continuing"
+					" to process line ignoring invalid characters: %r",
 					line)
 			# decode with replacing error chars:
 			line = line.decode(enc, 'replace')
 		return line

-	def readline(self, complete=True):
-		"""Read line from file
-
-		In opposite to pythons readline it doesn't return new-line, 
-		so returns either the line if line is complete (and complete=True) or None
-		if line is not complete (and complete=True) or there is no content to read.
-		If line is complete (and complete is True), it also shift current known 
-		position to begin of next line.
-
-		Also it is safe against interim new-line bytes (e. g. part of multi-byte char)
-		in given encoding.
-		"""
+	def readline(self):
 		if self.__handler is None:
 			return ""
-		# read raw bytes up to \n char:
-		b = self.__handler.readline()
-		if not b:
-			return None
-		bl = len(b)
-		# convert to log-encoding (new-line char could disappear if it is part of multi-byte sequence):
-		r = FileContainer.decode_line(
-			self.getFileName(), self.getEncoding(), b)
-		# trim new-line at end and check the line was written complete (contains a new-line):
-		l = r.rstrip('\r\n')
-		if complete:
-			if l == r:
-				# try to fill buffer in order to find line-end in log encoding:
-				fnd = 0
-				while 1:
-					r = self.__handler.readline()
-					if not r:
-						break
-					b += r
-					bl += len(r)
-					# convert to log-encoding:
-					r = FileContainer.decode_line(
-						self.getFileName(), self.getEncoding(), b)
-					# ensure new-line is not in the middle (buffered 2 strings, e. g. in utf-16le it is "...[0A"+"00]..."):
-					e = r.find('\n')
-					if e >= 0 and e != len(r)-1:
-						l, r = r[0:e], r[0:e+1]
-						# back to bytes and get offset to seek after NL:
-						r = r.encode(self.getEncoding(), 'replace')
-						self.__handler.seek(-bl+len(r), 1)
-						return l
-					# trim new-line at end and check the line was written complete (contains a new-line):
-					l = r.rstrip('\r\n')
-					if l != r:
-						return l
-				if self.waitForLineEnd:
-					# not fulfilled - seek back and return:
-					self.__handler.seek(-bl, 1)
-					return None
-		return l
+		return FileContainer.decode_line(
+			self.getFileName(), self.getEncoding(), self.__handler.readline())

 	def close(self):
-		if self.__handler is not None:
-			# Saves the last real position.
+		if not self.__handler is None:
+			# Saves the last position.
 			self.__pos = self.__handler.tell()
 			# Closes the file.
 			self.__handler.close()
 			self.__handler = None
-
-	def __iter__(self):
-		return self
-	def next(self):
-		line = self.readline()
-		if line is None:
-			self.close()
-			raise StopIteration
-		return line
+		## print "D: Closed %s with pos %d" % (handler, self.__pos)
+		## sys.stdout.flush()

 _decode_line_warn = Utils.Cache(maxCount=1000, maxTime=24*60*60);

@@ -358,7 +358,7 @@ class IPAddr(object):
 		return repr(self.ntoa)

 	def __str__(self):
-		return self.ntoa if isinstance(self.ntoa, basestring) else str(self.ntoa)
+		return self.ntoa

 	def __reduce__(self):
 		"""IPAddr pickle-handler, that simply wraps IPAddr to the str
@@ -24,13 +24,10 @@ __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2011-2012 Lee Clemens, 2012 Y
 __license__ = "GPL"

 import logging
-import math
-import random
 import Queue

 from .actions import Actions
-from ..helpers import getLogger, _as_bool, extractOptions, MyTime
-from .mytime import MyTime
+from ..helpers import getLogger, extractOptions, MyTime

 # Gets the instance of the logger.
 logSys = getLogger(__name__)
@@ -78,8 +75,6 @@ class Jail(object):
 		self.__name = name
 		self.__queue = Queue.Queue()
 		self.__filter = None
-		# Extra parameters for increase ban time
-		self._banExtra = {};
 		logSys.info("Creating new jail '%s'" % self.name)
 		if backend is not None:
 			self._setBackend(backend)
@@ -208,8 +203,6 @@ class Jail(object):
 		Used by filter to add a failure for banning.
 		"""
 		self.__queue.put(ticket)
-		# add ban to database moved to observer (should previously check not already banned 
-		# and increase ticket time if "bantime.increment" set)

 	def getFailTicket(self):
 		"""Get a fail ticket from the jail.
@@ -222,80 +215,16 @@ class Jail(object):
 		except Queue.Empty:
 			return False

-	def setBanTimeExtra(self, opt, value):
-		# merge previous extra with new option:
-		be = self._banExtra;
-		if value == '':
-			value = None
-		if value is not None:
-			be[opt] = value;
-		elif opt in be:
-			del be[opt]
-		logSys.info('Set banTime.%s = %s', opt, value)
-		if opt == 'increment':
-			be[opt] = _as_bool(value)
-			if be.get(opt) and self.database is None:
-				logSys.warning("ban time increment is not available as long jail database is not set")
-		if opt in ['maxtime', 'rndtime']:
-			if not value is None:
-				be[opt] = MyTime.str2seconds(value)
-		# prepare formula lambda:
-		if opt in ['formula', 'factor', 'maxtime', 'rndtime', 'multipliers'] or be.get('evformula', None) is None:
-			# split multifiers to an array begins with 0 (or empty if not set):
-			if opt == 'multipliers':
-				be['evmultipliers'] = [int(i) for i in (value.split(' ') if value is not None and value != '' else [])]
-			# if we have multifiers - use it in lambda, otherwise compile and use formula within lambda
-			multipliers = be.get('evmultipliers', [])
-			banFactor = eval(be.get('factor', "1"))
-			if len(multipliers):
-				evformula = lambda ban, banFactor=banFactor: (
-					ban.Time * banFactor * multipliers[ban.Count if ban.Count < len(multipliers) else -1]
-				)
-			else:
-				formula = be.get('formula', 'ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor')
-				formula = compile(formula, '~inline-conf-expr~', 'eval')
-				evformula = lambda ban, banFactor=banFactor, formula=formula: max(ban.Time, eval(formula))
-			# extend lambda with max time :
-			if not be.get('maxtime', None) is None:
-				maxtime = be['maxtime']
-				evformula = lambda ban, evformula=evformula: min(evformula(ban), maxtime)
-			# mix lambda with random time (to prevent bot-nets to calculate exact time IP can be unbanned):
-			if not be.get('rndtime', None) is None:
-				rndtime = be['rndtime']
-				evformula = lambda ban, evformula=evformula: (evformula(ban) + random.random() * rndtime)
-			# set to extra dict:
-			be['evformula'] = evformula
-		#logSys.info('banTimeExtra : %s' % json.dumps(be))
-
-	def getBanTimeExtra(self, opt=None):
-		if opt is not None:
-			return self._banExtra.get(opt, None)
-		return self._banExtra
-
-	def getMaxBanTime(self):
-		"""Returns max possible ban-time of jail.
-		"""
-		return self._banExtra.get("maxtime", -1) \
-			if self._banExtra.get('increment') else self.actions.getBanTime()
-
-	def restoreCurrentBans(self, correctBanTime=True):
+	def restoreCurrentBans(self):
 		"""Restore any previous valid bans from the database.
 		"""
 		try:
 			if self.database is not None:
-				if self._banExtra.get('increment'):
-					forbantime = None;
-					if correctBanTime:
-						correctBanTime = self.getMaxBanTime()
-				else:
-					# use ban time as search time if we have not enabled a increasing:
-					forbantime = self.actions.getBanTime()
-				for ticket in self.database.getCurrentBans(jail=self, forbantime=forbantime,
-					correctBanTime=correctBanTime, maxmatches=self.filter.failManager.maxMatches
-				):
-					try:
-						#logSys.debug('restored ticket: %s', ticket)
-						if self.filter.inIgnoreIPList(ticket.getIP(), log_ignore=True): continue
+				forbantime = self.actions.getBanTime()
+				for ticket in self.database.getCurrentBans(jail=self, 
+						forbantime=forbantime, maxmatches=self.filter.failManager.maxMatches):
+					#logSys.debug('restored ticket: %s', ticket)
+					if not self.filter.inIgnoreIPList(ticket.getIP(), log_ignore=True):
 						# mark ticked was restored from database - does not put it again into db:
 						ticket.restored = True
 						# correct start time / ban time (by the same end of ban):
@@ -306,13 +235,11 @@ class Jail(object):
 						# ignore obsolete tickets:
 						if btm != -1 and btm <= 0:
 							continue
+						ticket.setTime(MyTime.time())
+						ticket.setBanTime(btm)
 						self.putFailTicket(ticket)
-					except Exception as e: # pragma: no cover
-						logSys.error('Restore ticket failed: %s', e, 
-							exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
 		except Exception as e: # pragma: no cover
-			logSys.error('Restore bans failed: %s', e,
-				exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
+			logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)

 	def start(self):
 		"""Start the jail, by starting filter and actions threads.
@@ -113,19 +113,6 @@ class MyTime:
 			return time.localtime(x)
 		else:
 			return time.localtime(MyTime.myTime)
-	
-	@staticmethod
-	def time2str(unixTime, format="%Y-%m-%d %H:%M:%S"):
-		"""Convert time to a string representing as date and time using given format.
-		Default format is ISO 8601, YYYY-MM-DD HH:MM:SS without microseconds.
-
-		@return ISO-capable string representation of given unixTime
-		"""
-		# consider end of 9999th year (in GMT+23 to avoid year overflow in other TZ)
-		dt = datetime.datetime.fromtimestamp(
-			unixTime).replace(microsecond=0
-		) if unixTime < 253402214400 else datetime.datetime(9999, 12, 31, 23, 59, 59)
-		return dt.strftime(format)

 	## precreate/precompile primitives used in str2seconds:

@@ -1,535 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Serg G. Brester (sebres)
-# 
-# This module was written as part of ban time increment feature.
-
-__author__ = "Serg G. Brester (sebres)"
-__copyright__ = "Copyright (c) 2014 Serg G. Brester"
-__license__ = "GPL"
-
-import threading
-from .jailthread import JailThread
-from .failmanager import FailManagerEmpty
-import os, logging, time, datetime, math, json, random
-import sys
-from ..helpers import getLogger
-from .mytime import MyTime
-from .utils import Utils
-
-# Gets the instance of the logger.
-logSys = getLogger(__name__)
-
-class ObserverThread(JailThread):
-	"""Handles observing a database, managing bad ips and ban increment.
-
-	Parameters
-	----------
-
-	Attributes
-	----------
-	daemon
-	ident
-	name
-	status
-	active : bool
-		Control the state of the thread.
-	idle : bool
-		Control the idle state of the thread.
-	sleeptime : int
-		The time the thread sleeps for in the loop.
-	"""
-
-	# observer is event driven and it sleep organized incremental, so sleep intervals can be shortly:
-	DEFAULT_SLEEP_INTERVAL = Utils.DEFAULT_SLEEP_INTERVAL / 10
-
-	def __init__(self):
-    # init thread
-		super(ObserverThread, self).__init__(name='f2b/observer')
-		# before started - idle:
-		self.idle = True
-		## Event queue
-		self._queue_lock = threading.RLock()
-		self._queue = []
-		## Event, be notified if anything added to event queue
-		self._notify = threading.Event()
-		## Sleep for max 60 seconds, it possible to specify infinite to always sleep up to notifying via event, 
-		## but so we can later do some service "events" occurred infrequently directly in main loop of observer (not using queue)
-		self.sleeptime = 60
-		#
-		self._timers = {}
-		self._paused = False
-		self.__db = None
-		self.__db_purge_interval = 60*60
-		# observer is a not main thread:
-		self.daemon = True
-
-	def __getitem__(self, i):
-		try:
-			return self._queue[i]
-		except KeyError:
-			raise KeyError("Invalid event index : %s" % i)
-
-	def __delitem__(self, i):
-		try:
-			del self._queue[i]
-		except KeyError:
-			raise KeyError("Invalid event index: %s" % i)
-
-	def __iter__(self):
-		return iter(self._queue)
-
-	def __len__(self):
-		return len(self._queue)
-
-	def __eq__(self, other): # Required for Threading
-		return False
-
-	def __hash__(self): # Required for Threading
-		return id(self)
-
-	def add_named_timer(self, name, starttime, *event):
-		"""Add a named timer event to queue will start (and wake) in 'starttime' seconds
-		
-		Previous timer event with same name will be canceled and trigger self into 
-		queue after new 'starttime' value
-		"""
-		t = self._timers.get(name, None)
-		if t is not None:
-			t.cancel()
-		t = threading.Timer(starttime, self.add, event)
-		self._timers[name] = t
-		t.start()
-
-	def add_timer(self, starttime, *event):
-		"""Add a timer event to queue will start (and wake) in 'starttime' seconds
-		"""
-		# in testing we should wait (looping) for the possible time drifts:
-		if MyTime.myTime is not None and starttime:
-			# test time after short sleep:
-			t = threading.Timer(Utils.DEFAULT_SLEEP_INTERVAL, self._delayedEvent,
-				(MyTime.time() + starttime, time.time() + starttime, event)
-			)
-			t.start()
-			return
-		# add timer event:
-		t = threading.Timer(starttime, self.add, event)
-		t.start()
-
-	def _delayedEvent(self, endMyTime, endTime, event):
-		if MyTime.time() >= endMyTime or time.time() >= endTime:
-			self.add_timer(0, *event)
-			return
-		# repeat after short sleep:
-		t = threading.Timer(Utils.DEFAULT_SLEEP_INTERVAL, self._delayedEvent,
-			(endMyTime, endTime, event)
-		)
-		t.start()
-
-	def pulse_notify(self):
-		"""Notify wakeup (sets /and resets/ notify event)
-		"""
-		if not self._paused:
-			n = self._notify
-			if n:
-				n.set()
-				#n.clear()
-
-	def add(self, *event):
-		"""Add a event to queue and notify thread to wake up.
-		"""
-		## lock and add new event to queue:
-		with self._queue_lock:
-			self._queue.append(event)
-		self.pulse_notify()
-
-	def add_wn(self, *event):
-		"""Add a event to queue withouth notifying thread to wake up.
-		"""
-		## lock and add new event to queue:
-		with self._queue_lock:
-			self._queue.append(event)
-
-	def call_lambda(self, l, *args):
-		l(*args)
-
-	def run(self):
-		"""Main loop for Threading.
-
-		This function is the main loop of the thread.
-
-		Returns
-		-------
-		bool
-			True when the thread exits nicely.
-		"""
-		logSys.info("Observer start...")
-		## first time create named timer to purge database each hour (clean old entries) ...
-		self.add_named_timer('DB_PURGE', self.__db_purge_interval, 'db_purge')
-		## Mapping of all possible event types of observer:
-		__meth = {
-			# universal lambda:
-			'call': self.call_lambda,
-			# system and service events:
-			'db_set': self.db_set,
-			'db_purge': self.db_purge,
-			# service events of observer self:
-			'is_alive' : self.isAlive,
-			'is_active': self.isActive,
-			'start': self.start,
-			'stop': self.stop,
-			'nop': lambda:(),
-			'shutdown': lambda:()
-		}
-		try:
-			## check it self with sending is_alive event
-			self.add('is_alive')
-			## if we should stop - break a main loop
-			while self.active:
-				self.idle = False
-				## check events available and execute all events from queue
-				while not self._paused:
-					## lock, check and pop one from begin of queue:
-					try:
-						ev = None
-						with self._queue_lock:
-							if len(self._queue):
-								ev = self._queue.pop(0)
-						if ev is None:
-							break
-						## retrieve method by name
-						meth = ev[0]
-						if not callable(ev[0]): meth = __meth.get(meth) or getattr(self, meth)
-						## execute it with rest of event as variable arguments
-						meth(*ev[1:])
-					except Exception as e:
-						#logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
-						logSys.error('%s', e, exc_info=True)
-				## going sleep, wait for events (in queue)
-				n = self._notify
-				if n:
-					self.idle = True
-					n.wait(self.sleeptime)
-					## wake up - reset signal now (we don't need it so long as we reed from queue)
-					n.clear()
-					if self._paused:
-						continue
-				else:
-					## notify event deleted (shutdown) - just sleep a little bit (waiting for shutdown events, prevent high cpu usage)
-					time.sleep(ObserverThread.DEFAULT_SLEEP_INTERVAL)
-					## stop by shutdown and empty queue :
-					if not self.is_full:
-						break
-				## end of main loop - exit
-			logSys.info("Observer stopped, %s events remaining.", len(self._queue))
-			self._notify = None
-			#print("Observer stopped, %s events remaining." % len(self._queue))
-		except Exception as e:
-			logSys.error('Observer stopped after error: %s', e, exc_info=True)
-			#print("Observer stopped with error: %s" % str(e))
-		# clear all events - exit, for possible calls of wait_empty:
-		with self._queue_lock:
-			self._queue = []
-		self.idle = True
-		return True
-
-	def isAlive(self):
-		#logSys.debug("Observer alive...")
-		return True
-
-	def isActive(self, fromStr=None):
-		# logSys.info("Observer alive, %s%s", 
-		# 	'active' if self.active else 'inactive', 
-		# 	'' if fromStr is None else (", called from '%s'" % fromStr))
-		return self.active
-
-	def start(self):
-		with self._queue_lock:
-			if not self.active:
-				super(ObserverThread, self).start()
-
-	def stop(self, wtime=5, forceQuit=True):
-		if self.active and self._notify:
-			logSys.info("Observer stop ... try to end queue %s seconds", wtime)
-			#print("Observer stop ....")
-			# just add shutdown job to make possible wait later until full (events remaining)
-			with self._queue_lock:
-				self.add_wn('shutdown')
-				#don't pulse - just set, because we will delete it hereafter (sometimes not wakeup)
-				n = self._notify
-				self._notify.set()
-				#self.pulse_notify()
-				self._notify = None
-			# wait max wtime seconds until full (events remaining)
-			if self.wait_empty(wtime) or forceQuit:
-				n.clear()
-				self.active = False; # leave outer (active) loop
-				self._paused = True; # leave inner (queue) loop
-				self.__db = None
-			else:
-				self._notify = n
-			return self.wait_idle(min(wtime, 0.5)) and not self.is_full
-		return True
-
-	@property
-	def is_full(self):
-		with self._queue_lock:
-			return True if len(self._queue) else False
-
-	def wait_empty(self, sleeptime=None):
-		"""Wait observer is running and returns if observer has no more events (queue is empty)
-		"""
-		time.sleep(ObserverThread.DEFAULT_SLEEP_INTERVAL)
-		if sleeptime is not None:
-			e = MyTime.time() + sleeptime
-		# block queue with not operation to be sure all really jobs are executed if nop goes from queue :
-		if self._notify is not None:
-			self.add_wn('nop')
-			if self.is_full and self.idle:
-				self.pulse_notify()
-		while self.is_full:
-			if sleeptime is not None and MyTime.time() > e:
-				break
-			time.sleep(ObserverThread.DEFAULT_SLEEP_INTERVAL)
-		# wait idle to be sure the last queue element is processed (because pop event before processing it) :
-		self.wait_idle(0.001)
-		return not self.is_full
-
-
-	def wait_idle(self, sleeptime=None):
-		"""Wait observer is running and returns if observer idle (observer sleeps)
-		"""
-		time.sleep(ObserverThread.DEFAULT_SLEEP_INTERVAL)
-		if self.idle:
-			return True
-		if sleeptime is not None:
-			e = MyTime.time() + sleeptime
-		while not self.idle:
-			if sleeptime is not None and MyTime.time() > e:
-				break
-			time.sleep(ObserverThread.DEFAULT_SLEEP_INTERVAL)
-		return self.idle
-
-	@property
-	def paused(self):
-		return self._paused;
-
-	@paused.setter
-	def paused(self, pause):
-		if self._paused == pause:
-			return
-		self._paused = pause
-		# wake after pause ended
-		self.pulse_notify()
-
-
-	@property
-	def status(self):
-		"""Status of observer to be implemented. [TODO]
-		"""
-		return ('', '')
-
-	## -----------------------------------------
-	## [Async] database service functionality ...
-	## -----------------------------------------
-
-	def db_set(self, db):
-		self.__db = db
-
-	def db_purge(self):
-		logSys.debug("Purge database event occurred")
-		if self.__db is not None:
-			self.__db.purge()
-		# trigger timer again ...
-		self.add_named_timer('DB_PURGE', self.__db_purge_interval, 'db_purge')
-
-	## -----------------------------------------
-	## [Async] ban time increment functionality ...
-	## -----------------------------------------
-
-	def failureFound(self, failManager, jail, ticket):
-		""" Notify observer a failure for ip was found
-
-		Observer will check ip was known (bad) and possibly increase an retry count
-		"""
-		# check jail active :
-		if not jail.isAlive() or not jail.getBanTimeExtra("increment"):
-			return
-		ip = ticket.getIP()
-		unixTime = ticket.getTime()
-		logSys.debug("[%s] Observer: failure found %s", jail.name, ip)
-		# increase retry count for known (bad) ip, corresponding banCount of it (one try will count than 2, 3, 5, 9 ...)  :
-		banCount = 0
-		retryCount = 1
-		timeOfBan = None
-		try:
-			maxRetry = failManager.getMaxRetry()
-			db = jail.database
-			if db is not None:
-				for banCount, timeOfBan, lastBanTime in db.getBan(ip, jail):
-					banCount = max(banCount, ticket.getBanCount())
-					retryCount = ((1 << (banCount if banCount < 20 else 20))/2 + 1)
-					# if lastBanTime == -1 or timeOfBan + lastBanTime * 2 > MyTime.time():
-					# 	retryCount = maxRetry
-					break
-				retryCount = min(retryCount, maxRetry)
-				# check this ticket already known (line was already processed and in the database and will be restored from there):
-				if timeOfBan is not None and unixTime <= timeOfBan:
-					logSys.debug("[%s] Ignore failure %s before last ban %s < %s, restored",
-								jail.name, ip, unixTime, timeOfBan)
-					return
-			# for not increased failures observer should not add it to fail manager, because was already added by filter self
-			if retryCount <= 1:
-				return
-			# retry counter was increased - add it again:
-			logSys.info("[%s] Found %s, bad - %s, %s # -> %s%s", jail.name, ip, 
-				MyTime.time2str(unixTime), banCount, retryCount,
-				(', Ban' if retryCount >= maxRetry else ''))
-			# retryCount-1, because a ticket was already once incremented by filter self
-			retryCount = failManager.addFailure(ticket, retryCount - 1, True)
-			ticket.setBanCount(banCount)
-			# after observe we have increased attempt count, compare it >= maxretry ...
-			if retryCount >= maxRetry:
-				# perform the banning of the IP now (again)
-				# [todo]: this code part will be used multiple times - optimize it later.
-				try: # pragma: no branch - exception is the only way out
-					while True:
-						ticket = failManager.toBan(ip)
-						jail.putFailTicket(ticket)
-				except FailManagerEmpty:
-					failManager.cleanup(MyTime.time())
-
-		except Exception as e:
-			logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
-
-
-	class BanTimeIncr:
-		def __init__(self, banTime, banCount):
-			self.Time = banTime
-			self.Count = banCount
-
-	def calcBanTime(self, jail, banTime, banCount):
-		be = jail.getBanTimeExtra()
-		return be['evformula'](self.BanTimeIncr(banTime, banCount))
-
-	def incrBanTime(self, jail, banTime, ticket):
-		"""Check for IP address to increment ban time (if was already banned).
-
-		Returns
-		-------
-		float
-			new ban time.
-		"""
-		# check jail active :
-		if not jail.isAlive() or not jail.database:
-			return banTime
-		be = jail.getBanTimeExtra()
-		ip = ticket.getIP()
-		orgBanTime = banTime
-		# check ip was already banned (increment time of ban):
-		try:
-			if banTime > 0 and be.get('increment', False):
-				# search IP in database and increase time if found:
-				for banCount, timeOfBan, lastBanTime in \
-					jail.database.getBan(ip, jail, overalljails=be.get('overalljails', False)) \
-				:
-					# increment count in ticket (if still not increased from banmanager, test-cases?):
-					if banCount >= ticket.getBanCount():
-						ticket.setBanCount(banCount+1)
-					logSys.debug('IP %s was already banned: %s #, %s', ip, banCount, timeOfBan);
-					# calculate new ban time
-					if banCount > 0:
-						banTime = be['evformula'](self.BanTimeIncr(banTime, banCount))
-					ticket.setBanTime(banTime)
-					# check current ticket time to prevent increasing for twice read tickets (restored from log file besides database after restart)
-					if ticket.getTime() > timeOfBan:
-						logSys.info('[%s] IP %s is bad: %s # last %s - incr %s to %s' % (jail.name, ip, banCount, 
-							MyTime.time2str(timeOfBan), 
-							MyTime.seconds2str(orgBanTime), MyTime.seconds2str(banTime)))
-					else:
-						ticket.restored = True
-					break
-		except Exception as e:
-			logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
-		return banTime
-
-	def banFound(self, ticket, jail, btime):
-		""" Notify observer a ban occured for ip
-
-		Observer will check ip was known (bad) and possibly increase/prolong a ban time
-		Secondary we will actualize the bans and bips (bad ip) in database
-		"""
-		if ticket.restored: # pragma: no cover (normally not resored tickets only)
-			return
-		try:
-			oldbtime = btime
-			ip = ticket.getIP()
-			logSys.debug("[%s] Observer: ban found %s, %s", jail.name, ip, btime)
-			# if not permanent and ban time was not set - check time should be increased:
-			if btime != -1 and ticket.getBanTime() is None:
-				btime = self.incrBanTime(jail, btime, ticket)
-				# if we should prolong ban time:
-				if btime == -1 or btime > oldbtime:
-					ticket.setBanTime(btime)
-			# if not permanent
-			if btime != -1:
-				bendtime = ticket.getTime() + btime
-				logtime = (MyTime.seconds2str(btime), MyTime.time2str(bendtime))
-				# check ban is not too old :
-				if bendtime < MyTime.time():
-					logSys.debug('Ignore old bantime %s', logtime[1])
-					return False
-			else:
-				logtime = ('permanent', 'infinite')
-			# if ban time was prolonged - log again with new ban time:
-			if btime != oldbtime:
-				logSys.notice("[%s] Increase Ban %s (%d # %s -> %s)", jail.name, 
-					ip, ticket.getBanCount(), *logtime)
-				# delayed prolonging ticket via actions that expected this (not later than 10 sec):
-				logSys.log(5, "[%s] Observer: prolong %s in %s", jail.name, ip, (btime, oldbtime))
-				self.add_timer(min(10, max(0, btime - oldbtime - 5)), self.prolongBan, ticket, jail)
-			# add ticket to database, but only if was not restored (not already read from database):
-			if jail.database is not None and not ticket.restored:
-				# add to database always only after ban time was calculated an not yet already banned:
-				jail.database.addBan(jail, ticket)
-		except Exception as e:
-			logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
-
-	def prolongBan(self, ticket, jail):
-		""" Notify observer a ban occured for ip
-
-		Observer will check ip was known (bad) and possibly increase/prolong a ban time
-		Secondary we will actualize the bans and bips (bad ip) in database
-		"""
-		try:
-			btime = ticket.getBanTime()
-			ip = ticket.getIP()
-			logSys.debug("[%s] Observer: prolong %s, %s", jail.name, ip, btime)
-			# prolong ticket via actions that expected this:
-			jail.actions._prolongBan(ticket)
-		except Exception as e:
-			logSys.error('%s', e, exc_info=logSys.getEffectiveLevel()<=logging.DEBUG)
-
-# Global observer initial created in server (could be later rewriten via singleton)
-class _Observers:
-	def __init__(self):
-		self.Main = None
-
-Observers = _Observers()
@@ -32,7 +32,6 @@ import signal
 import stat
 import sys

-from .observer import Observers, ObserverThread
 from .jails import Jails
 from .filter import DNSUtils, FileFilter, JournalFilter
 from .transmitter import Transmitter
@@ -112,7 +111,7 @@ class Server:
 		self.__prev_signals[s] = signal.getsignal(s)
 		signal.signal(s, new)

-	def start(self, sock, pidfile, force=False, observer=True, conf={}):
+	def start(self, sock, pidfile, force=False, conf={}):
 		# First set the mask to only allow access to owner
 		os.umask(0o077)
 		# Second daemonize before logging etc, because it will close all handles:
@@ -166,12 +165,6 @@ class Server:
 		except (OSError, IOError) as e: # pragma: no cover
 			logSys.error("Unable to create PID file: %s", e)
 		
-		# Create observers and start it:
-		if observer:
-			if Observers.Main is None:
-				Observers.Main = ObserverThread()
-				Observers.Main.start()
-
 		# Start the communication
 		logSys.debug("Starting communication")
 		try:
@@ -212,33 +205,21 @@ class Server:
 			for s, sh in self.__prev_signals.iteritems():
 				signal.signal(s, sh)

-		# Give observer a small chance to complete its work before exit
-		obsMain = Observers.Main
-		if obsMain is not None:
-			if obsMain.stop(forceQuit=False):
-				obsMain = None
-			Observers.Main = None
-
 		# Now stop all the jails
 		self.stopAllJail()

-		# Stop observer ultimately
-		if obsMain is not None:
-			obsMain.stop()
-
 		# Explicit close database (server can leave in a thread, 
 		# so delayed GC can prevent commiting changes)
 		if self.__db:
 			self.__db.close()
 			self.__db = None

-		# Stop async and exit
+		# Stop async
 		if self.__asyncServer is not None:
 			self.__asyncServer.stop()
 			self.__asyncServer = None
 		logSys.info("Exiting Fail2ban")

-
 	def addJail(self, name, backend):
 		addflg = True
 		if self.__reload_state.get(name) and self.__jails.exists(name):
@@ -391,7 +372,7 @@ class Server:
 		if isinstance(filter_, FileFilter):
 			return filter_.getLogPaths()
 		else: # pragma: systemd no cover
-			logSys.info("Jail %s is not a FileFilter instance" % name)
+			logSys.debug("Jail %s is not a FileFilter instance" % name)
 			return []
 	
 	def addJournalMatch(self, name, match): # pragma: systemd no cover
@@ -409,7 +390,7 @@ class Server:
 		if isinstance(filter_, JournalFilter):
 			return filter_.getJournalMatch()
 		else:
-			logSys.info("Jail %s is not a JournalFilter instance" % name)
+			logSys.debug("Jail %s is not a JournalFilter instance" % name)
 			return []
 	
 	def setLogEncoding(self, name, encoding):
@@ -575,27 +556,6 @@ class Server:
 		
 	def getBanTime(self, name):
 		return self.__jails[name].actions.getBanTime()
-
-	def getBanList(self, name, withTime=False):
-		"""Returns the list of banned IP addresses for a jail.
-
-		Parameters
-		----------
-		name : str
-			The name of a jail.
-
-		Returns
-		-------
-		list
-			The list of banned IP addresses.
-		"""
-		return self.__jails[name].actions.getBanList(withTime)
-
-	def setBanTimeExtra(self, name, opt, value):
-		self.__jails[name].setBanTimeExtra(opt, value)
-
-	def getBanTimeExtra(self, name, opt):
-		return self.__jails[name].getBanTimeExtra(opt)
 	
 	def isStarted(self):
 		return self.__asyncServer is not None and self.__asyncServer.isActive()
@@ -845,8 +805,6 @@ class Server:
 				logSys.error(
 					"Unable to import fail2ban database module as sqlite "
 					"is not available.")
-		if Observers.Main is not None:
-			Observers.Main.db_set(self.__db)
 	
 	def getDatabase(self):
 		return self.__db
@@ -271,12 +271,16 @@ def reGroupDictStrptime(found_dict, msec=False, default_tz=None):
 			week_of_year = int(val)
 			# U starts week on Sunday, W - on Monday
 			week_of_year_start = 6 if key == 'U' else 0
-		elif key in ('z', 'Z'):
+		elif key == 'z':
 			z = val
 			if z in ("Z", "UTC", "GMT"):
 				tzoffset = 0
 			else:
 				tzoffset = zone2offset(z, 0); # currently offset-based only
+		elif key == 'Z':
+			z = val
+			if z in ("UTC", "GMT"):
+				tzoffset = 0

 	# Fail2Ban will assume it's this year
 	assume_year = False
@@ -24,6 +24,8 @@ __author__ = "Cyril Jaquier"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier"
 __license__ = "GPL"

+import sys
+
 from ..helpers import getLogger
 from .ipdns import IPAddr
 from .mytime import MyTime
@@ -33,7 +35,6 @@ logSys = getLogger(__name__)


 class Ticket(object):
-	__slots__ = ('_ip', '_flags', '_banCount', '_banTime', '_time', '_data', '_retry', '_lastReset')

 	MAX_TIME = 0X7FFFFFFFFFFF ;# 4461763-th year
 	
@@ -60,44 +61,35 @@ class Ticket(object):
 					self._data[k] = v
 		if ticket:
 			# ticket available - copy whole information from ticket:
-			self.update(ticket)
-			#self.__dict__.update(i for i in ticket.__dict__.iteritems() if i[0] in self.__dict__)
+			self.__dict__.update(i for i in ticket.__dict__.iteritems() if i[0] in self.__dict__)

 	def __str__(self):
-		return "%s: ip=%s time=%s bantime=%s bancount=%s #attempts=%d matches=%r" % \
-				 (self.__class__.__name__.split('.')[-1], self._ip, self._time,
-					self._banTime, self._banCount,
-					self._data['failures'], self._data.get('matches', []))
+		return "%s: ip=%s time=%s #attempts=%d matches=%r" % \
+			   (self.__class__.__name__.split('.')[-1], self.__ip, self._time,
+			   	self._data['failures'], self._data.get('matches', []))

 	def __repr__(self):
 		return str(self)

 	def __eq__(self, other):
 		try:
-			return self._ip == other._ip and \
+			return self.__ip == other.__ip and \
 				round(self._time, 2) == round(other._time, 2) and \
 				self._data == other._data
 		except AttributeError:
 			return False

-	def update(self, ticket):
-		for n in ticket.__slots__:
-			v = getattr(ticket, n, None)
-			if v is not None:
-				setattr(self, n, v)
-
-
 	def setIP(self, value):
 		# guarantee using IPAddr instead of unicode, str for the IP
 		if isinstance(value, basestring):
 			value = IPAddr(value)
-		self._ip = value
+		self.__ip = value
 	
 	def getID(self):
-		return self._data.get('fid', self._ip)
+		return self._data.get('fid', self.__ip)
 	
 	def getIP(self):
-		return self._ip
+		return self.__ip
 	
 	def setTime(self, value):
 		self._time = value
@@ -106,17 +98,16 @@ class Ticket(object):
 		return self._time

 	def setBanTime(self, value):
-		self._banTime = value
+		self._banTime = value;

 	def getBanTime(self, defaultBT=None):
 		return (self._banTime if self._banTime is not None else defaultBT)

-	def setBanCount(self, value, always=False):
-		if always or value > self._banCount:
-			self._banCount = value
+	def setBanCount(self, value):
+		self._banCount = value;

-	def incrBanCount(self, value=1):
-		self._banCount += value
+	def incrBanCount(self, value = 1):
+		self._banCount += value;

 	def getBanCount(self):
 		return self._banCount;
@@ -276,19 +267,10 @@ class FailTicket(Ticket):
 			else:
 				self._data['matches'] = matches

-	@staticmethod
-	def wrap(o):
-		o.__class__ = FailTicket
-		return o
-
 ##
 # Ban Ticket.
 #
 # This class extends the Ticket class. It is mainly used by the BanManager.

-class BanTicket(FailTicket):
-	
-	@staticmethod
-	def wrap(o):
-		o.__class__ = BanTicket
-		return o
+class BanTicket(Ticket):
+	pass
@@ -353,12 +353,6 @@ class Transmitter:
 			value = command[2:]
 			if self.__quiet: return
 			return self.__server.addAttemptIP(name, *value)
-		elif command[1].startswith("bantime."):
-			value = command[2]
-			opt = command[1][len("bantime."):]
-			self.__server.setBanTimeExtra(name, opt, value)
-			if self.__quiet: return
-			return self.__server.getBanTimeExtra(name, opt)
 		elif command[1] == "banip":
 			value = command[2:]
 			return self.__server.setBanIP(name,value)
@@ -481,12 +475,6 @@ class Transmitter:
 		# Action
 		elif command[1] == "bantime":
 			return self.__server.getBanTime(name)
-		elif command[1] == "banip":
-			return self.__server.getBanList(name,
-				withTime=len(command) > 2 and command[2] == "--with-time")
-		elif command[1].startswith("bantime."):
-			opt = command[1][len("bantime."):]
-			return self.__server.getBanTimeExtra(name, opt)
 		elif command[1] == "actions":
 			return self.__server.getActions(name).keys()
 		elif command[1] == "action":
@@ -332,9 +332,11 @@ class Utils():
 					timeout_expr = lambda: time.time() > time0
 				else:
 					timeout_expr = timeout
+				if not interval:
+					interval = Utils.DEFAULT_SLEEP_INTERVAL
 			if timeout_expr():
 				break
-			stm = min(stm + (interval or Utils.DEFAULT_SLEEP_INTERVAL), Utils.DEFAULT_SLEEP_TIME)
+			stm = min(stm + interval, Utils.DEFAULT_SLEEP_TIME)
 			time.sleep(stm)
 		return ret

@@ -353,7 +355,7 @@ class Utils():
 				return e.errno == errno.EPERM
 			else:
 				return True
-	else: # pragma: no cover (no windows currently supported)
+	else: # pragma : no cover (no windows currently supported)
 		@staticmethod
 		def pid_exists(pid):
 			import ctypes
@@ -159,7 +159,7 @@ class ExecuteActions(LogCaptureTestCase):
 			"action2",
 			os.path.join(TEST_FILES_DIR, "action.d/action_modifyainfo.py"),
 			{})
-		self.__jail.putFailTicket(FailTicket("1.2.3.4"))
+		self.__jail.putFailTicket(FailTicket("1.2.3.4", 0))
 		self.__actions._Actions__checkBan()
 		# Will fail if modification of aInfo from first action propagates
 		# to second action, as both delete same key
@@ -217,9 +217,6 @@ class ExecuteActions(LogCaptureTestCase):
 		# flush for inet6 is intentionally "broken" here - test no unhandled except and invariant check:
 		act['actionflush?family=inet6'] = act.actionflush + '; exit 1'
 		act.actionstart_on_demand = True
-		# force errors via check in ban/unban:
-		act.actionban = "<actioncheck> ; " + act.actionban
-		act.actionunban = "<actioncheck> ; " + act.actionunban
 		self.__actions.start()
 		self.assertNotLogged("stdout: %r" % 'ip start')

@@ -297,9 +294,6 @@ class ExecuteActions(LogCaptureTestCase):
 		act['actionflush?family=inet6'] = act.actionflush + '; exit 1'
 		act.actionstart_on_demand = True
 		act.actionrepair_on_unban = True
-		# force errors via check in ban/unban:
-		act.actionban = "<actioncheck> ; " + act.actionban
-		act.actionunban = "<actioncheck> ; " + act.actionunban
 		self.__actions.start()
 		self.assertNotLogged("stdout: %r" % 'ip start')

@@ -207,15 +207,15 @@ class CommandActionTest(LogCaptureTestCase):
 		self.assertEqual(
 			self.__action.replaceTag("<matches>",
 				{'matches': "some >char< should \\< be[ escap}ed&\n"}),
-			"some \\>char\\< should \\\\\\< be\\[ escap\\}ed\\&\\n")
+			"some \\>char\\< should \\\\\\< be\\[ escap\\}ed\\&\n")
 		self.assertEqual(
 			self.__action.replaceTag("<ipmatches>",
 				{'ipmatches': "some >char< should \\< be[ escap}ed&\n"}),
-			"some \\>char\\< should \\\\\\< be\\[ escap\\}ed\\&\\n")
+			"some \\>char\\< should \\\\\\< be\\[ escap\\}ed\\&\n")
 		self.assertEqual(
 			self.__action.replaceTag("<ipjailmatches>",
-				{'ipjailmatches': "some >char< should \\< be[ escap}ed&\r\n"}),
-			"some \\>char\\< should \\\\\\< be\\[ escap\\}ed\\&\\r\\n")
+				{'ipjailmatches': "some >char< should \\< be[ escap}ed&\n"}),
+			"some \\>char\\< should \\\\\\< be\\[ escap\\}ed\\&\n")

 		# Recursive
 		aInfo["ABC"] = "<xyz>"
@@ -305,8 +305,8 @@ class CommandActionTest(LogCaptureTestCase):
 		self.assertEqual(self.__action.actionstart, "touch '%s'" % tmp)
 		self.__action.actionstop = "rm -f '%s'" % tmp
 		self.assertEqual(self.__action.actionstop, "rm -f '%s'" % tmp)
-		self.__action.actionban = "<actioncheck> && echo -n"
-		self.assertEqual(self.__action.actionban, "<actioncheck> && echo -n")
+		self.__action.actionban = "echo -n"
+		self.assertEqual(self.__action.actionban, 'echo -n')
 		self.__action.actioncheck = "[ -e '%s' ]" % tmp
 		self.assertEqual(self.__action.actioncheck, "[ -e '%s' ]" % tmp)
 		self.__action.actionunban = "true"
@@ -316,7 +316,6 @@ class CommandActionTest(LogCaptureTestCase):
 		self.assertNotLogged('returned')
 		# no action was actually executed yet

-		# start on demand is false, so it should cause failure on first attempt of ban:
 		self.__action.ban({'ip': None})
 		self.assertLogged('Invariant check failed')
 		self.assertLogged('returned successfully')
@@ -366,51 +365,12 @@ class CommandActionTest(LogCaptureTestCase):
 		self.pruneLog('[phase 2]')
 		self.__action.actionstart = "touch '%s'" % tmp
 		self.__action.actionstop = "rm '%s'" % tmp
-		self.__action.actionban = """<actioncheck> && printf "%%%%b\n" <ip> >> '%s'""" % tmp
+		self.__action.actionban = """printf "%%%%b\n" <ip> >> '%s'""" % tmp
 		self.__action.actioncheck = "[ -e '%s' ]" % tmp
 		self.__action.ban({'ip': None})
 		self.assertLogged('Invariant check failed')
 		self.assertNotLogged('Unable to restore environment')

-	@with_tmpdir
-	def testExecuteActionCheckOnBanFailure(self, tmp):
-		tmp += '/fail2ban.test'
-		self.__action.actionstart = "touch '%s'; echo 'started ...'" % tmp
-		self.__action.actionstop = "rm -f '%s'" % tmp
-		self.__action.actionban = "[ -e '%s' ] && echo 'banned '<ip>" % tmp
-		self.__action.actioncheck = "[ -e '%s' ] && echo 'check ok' || { echo 'check failed'; exit 1; }" % tmp
-		self.__action.actionrepair = "echo 'repair ...'; touch '%s'" % tmp
-		self.__action.actionstart_on_demand = False
-		self.__action.start()
-		# phase 1: with repair;
-		# phase 2: without repair (start/stop), not on demand;
-		# phase 3: without repair (start/stop), start on demand.
-		for i in (1, 2, 3):
-			self.pruneLog('[phase %s]' % i)
-			# 1st time with success ban:
-			self.__action.ban({'ip': '192.0.2.1'})
-			self.assertLogged(
-				"stdout: %r" % 'banned 192.0.2.1', all=True)
-			self.assertNotLogged("Invariant check failed. Trying", 
-				"stdout: %r" % 'check failed',
-				"stdout: %r" % ('repair ...' if self.__action.actionrepair else 'started ...'),
-				"stdout: %r" % 'check ok', all=True)
-			# force error in ban:
-			os.remove(tmp)
-			self.pruneLog()
-			# 2nd time with fail recognition, success repair, check and ban:
-			self.__action.ban({'ip': '192.0.2.2'})
-			self.assertLogged("Invariant check failed. Trying",
-				"stdout: %r" % 'check failed',
-				"stdout: %r" % ('repair ...' if self.__action.actionrepair else 'started ...'),
-				"stdout: %r" % 'check ok', 
-				"stdout: %r" % 'banned 192.0.2.2', all=True)
-			# repeat without repair (stop/start), herafter enable on demand:
-			if self.__action.actionrepair:
-				self.__action.actionrepair = ""
-			elif not self.__action.actionstart_on_demand:
-				self.__action.actionstart_on_demand = True
-
 	@with_tmpdir
 	def testExecuteActionCheckRepairEnvironment(self, tmp):
 		tmp += '/fail2ban.test'
@@ -26,8 +26,6 @@ __license__ = "GPL"

 import unittest

-from .utils import setUpMyTime, tearDownMyTime
-
 from ..server.banmanager import BanManager
 from ..server.ipdns import DNSUtils
 from ..server.ticket import BanTicket
@@ -36,14 +34,12 @@ class AddFailure(unittest.TestCase):
 	def setUp(self):
 		"""Call before every test case."""
 		super(AddFailure, self).setUp()
-		setUpMyTime()
 		self.__ticket = BanTicket('193.168.0.128', 1167605999.0)
 		self.__banManager = BanManager()

 	def tearDown(self):
 		"""Call after every test case."""
 		super(AddFailure, self).tearDown()
-		tearDownMyTime()

 	def testAdd(self):
 		self.assertTrue(self.__banManager.addBanTicket(self.__ticket))
@@ -98,25 +94,6 @@ class AddFailure(unittest.TestCase):
 		self.assertTrue(self.__banManager.addBanTicket(self.__ticket))
 		ticket = BanTicket('111.111.1.111', 1167605999.0)
 		self.assertFalse(self.__banManager._inBanList(ticket))
-		
-	def testBanTimeIncr(self):
-		ticket = BanTicket(self.__ticket.getIP(), self.__ticket.getTime())
-		## increase twice and at end permanent, check time/count increase:
-		c = 0
-		for i in (1000, 2000, -1):
-			self.__banManager.addBanTicket(self.__ticket); c += 1
-			ticket.setBanTime(i)
-			self.assertFalse(self.__banManager.addBanTicket(ticket)); # no incr of c (already banned)
-			self.assertEqual(str(self.__banManager.getTicketByID(ticket.getIP())), 
-				"BanTicket: ip=%s time=%s bantime=%s bancount=%s #attempts=0 matches=[]" % (ticket.getIP(), ticket.getTime(), i, c))
-		## after permanent, it should remain permanent ban time (-1):
-		self.__banManager.addBanTicket(self.__ticket); c += 1
-		ticket.setBanTime(-1)
-		self.assertFalse(self.__banManager.addBanTicket(ticket)); # no incr of c (already banned)
-		ticket.setBanTime(1000)
-		self.assertFalse(self.__banManager.addBanTicket(ticket)); # no incr of c (already banned)
-		self.assertEqual(str(self.__banManager.getTicketByID(ticket.getIP())), 
-			"BanTicket: ip=%s time=%s bantime=%s bancount=%s #attempts=0 matches=[]" % (ticket.getIP(), ticket.getTime(), -1, c))

 	def testUnban(self):
 		btime = self.__banManager.getBanTime()
@@ -155,28 +132,12 @@ class AddFailure(unittest.TestCase):
 		finally:
 			self.__banManager.setBanTime(btime)

-	def testBanList(self):
-		tickets = [
-			BanTicket('192.0.2.1', 1167605999.0),
-			BanTicket('192.0.2.2', 1167605999.0),
-		]
-		tickets[1].setBanTime(-1)
-		for t in tickets:
-			self.__banManager.addBanTicket(t)
-		self.assertSortedEqual(self.__banManager.getBanList(ordered=True, withTime=True),
-			[
-			  '192.0.2.1 \t2006-12-31 23:59:59 + 600 = 2007-01-01 00:09:59',
-			  '192.0.2.2 \t2006-12-31 23:59:59 + -1 = 9999-12-31 23:59:59'
-			]
-		)
-

 class StatusExtendedCymruInfo(unittest.TestCase):
 	def setUp(self):
 		"""Call before every test case."""
 		super(StatusExtendedCymruInfo, self).setUp()
 		unittest.F2B.SkipIfNoNetwork()
-		setUpMyTime()
 		self.__ban_ip = iter(DNSUtils.dnsToIp("resolver1.opendns.com")).next()
 		self.__asn = "36692"
 		self.__country = "US"
@@ -188,7 +149,6 @@ class StatusExtendedCymruInfo(unittest.TestCase):
 	def tearDown(self):
 		"""Call after every test case."""
 		super(StatusExtendedCymruInfo, self).tearDown()
-		tearDownMyTime()

 	available = True, None

@@ -29,7 +29,7 @@ import tempfile
 import sqlite3
 import shutil

-from ..server.filter import FileContainer, Filter
+from ..server.filter import FileContainer
 from ..server.mytime import MyTime
 from ..server.ticket import FailTicket
 from ..server.actions import Actions, Utils
@@ -164,47 +164,10 @@ class DatabaseTest(LogCaptureTestCase):

 			self.assertEqual(self.db.updateDb(Fail2BanDb.__version__), Fail2BanDb.__version__)
 			self.assertRaises(NotImplementedError, self.db.updateDb, Fail2BanDb.__version__ + 1)
-			# check current bans (should find exactly 1 ticket after upgrade):
-			tickets = self.db.getCurrentBans(fromtime=1388009242, correctBanTime=123456)
-			self.assertEqual(len(tickets), 1)
-			self.assertEqual(tickets[0].getBanTime(), 123456); # ban-time was unknown (normally updated from jail)
 		finally:
 			if self.db and self.db._dbFilename != ":memory:":
 				os.remove(self.db._dbBackupFilename)

-	def testUpdateDb2(self):
-		self.db = None
-		if self.dbFilename is None: # pragma: no cover
-			_, self.dbFilename = tempfile.mkstemp(".db", "fail2ban_")
-		shutil.copyfile(
-			os.path.join(TEST_FILES_DIR, 'database_v2.db'), self.dbFilename)
-		self.db = Fail2BanDb(self.dbFilename)
-		self.assertEqual(self.db.getJailNames(), set(['pam-generic']))
-		self.assertEqual(self.db.getLogPaths(), set(['/var/log/auth.log']))
-		bans = self.db.getBans()
-		self.assertEqual(len(bans), 2)
-		# compare first ticket completely:
-		ticket = FailTicket("1.2.3.7", 1417595494, [
-			u'Dec  3 09:31:08 f2btest test:auth[27658]: pam_unix(test:auth): authentication failure; logname= uid=0 euid=0 tty=test ruser= rhost=1.2.3.7',
-			u'Dec  3 09:31:32 f2btest test:auth[27671]: pam_unix(test:auth): authentication failure; logname= uid=0 euid=0 tty=test ruser= rhost=1.2.3.7',
-			u'Dec  3 09:31:34 f2btest test:auth[27673]: pam_unix(test:auth): authentication failure; logname= uid=0 euid=0 tty=test ruser= rhost=1.2.3.7'
-		])
-		ticket.setAttempt(3)
-		self.assertEqual(bans[0], ticket)
-		# second ban found also:
-		self.assertEqual(bans[1].getIP(), "1.2.3.8")
-		# updated ?
-		self.assertEqual(self.db.updateDb(Fail2BanDb.__version__), Fail2BanDb.__version__)
-		# check current bans (should find 2 tickets after upgrade):
-		self.jail = DummyJail(name='pam-generic')
-		tickets = self.db.getCurrentBans(jail=self.jail, fromtime=1417595494)
-		self.assertEqual(len(tickets), 2)
-		self.assertEqual(tickets[0].getBanTime(), 600)
-		# further update should fail:
-		self.assertRaises(NotImplementedError, self.db.updateDb, Fail2BanDb.__version__ + 1)
-		# clean:
-		os.remove(self.db._dbBackupFilename)
-
 	def testAddJail(self):
 		self.jail = DummyJail()
 		self.db.addJail(self.jail)
@@ -212,20 +175,19 @@ class DatabaseTest(LogCaptureTestCase):
 			self.jail.name in self.db.getJailNames(True),
 			"Jail not added to database")

-	def _testAddLog(self):
+	def testAddLog(self):
 		self.testAddJail() # Jail required

 		_, filename = tempfile.mkstemp(".log", "Fail2BanDb_")
 		self.fileContainer = FileContainer(filename, "utf-8")

-		pos = self.db.addLog(self.jail, self.fileContainer)
-		self.assertTrue(pos is None); # unknown previously
+		self.db.addLog(self.jail, self.fileContainer)

 		self.assertIn(filename, self.db.getLogPaths(self.jail))
 		os.remove(filename)

 	def testUpdateLog(self):
-		self._testAddLog() # Add log file
+		self.testAddLog() # Add log file

 		# Write some text
 		filename = self.fileContainer.getFileName()
@@ -438,7 +400,7 @@ class DatabaseTest(LogCaptureTestCase):
 	def testGetBansMerged(self):
 		self.testAddJail()

-		jail2 = DummyJail(name='DummyJail-2')
+		jail2 = DummyJail()
 		self.db.addJail(jail2)

 		ticket = FailTicket("127.0.0.1", MyTime.time() - 40, ["abc\n"])
@@ -520,46 +482,26 @@ class DatabaseTest(LogCaptureTestCase):
 		tickets = self.db.getCurrentBans(jail=self.jail, forbantime=15,
 			fromtime=MyTime.time() + MyTime.str2seconds("1year"))
 		self.assertEqual(len(tickets), 0)
-		# persistent bantime (-1), so never expired (but no persistent tickets):
+		# persistent bantime (-1), so never expired:
 		tickets = self.db.getCurrentBans(jail=self.jail, forbantime=-1,
 			fromtime=MyTime.time() + MyTime.str2seconds("1year"))
-		self.assertEqual(len(tickets), 0)
-		# add persistent one:
-		ticket.setBanTime(-1)
-		self.db.addBan(self.jail, ticket)
-		# persistent bantime (-1), so never expired (but jail has other max bantime now):
-		tickets = self.db.getCurrentBans(jail=self.jail, forbantime=-1,
-			fromtime=MyTime.time() + MyTime.str2seconds("1year"))
-		# no tickets should be found (max ban time = 600):
-		self.assertEqual(len(tickets), 0)
-		self.assertLogged("ignore ticket (with new max ban-time %r)" % self.jail.getMaxBanTime())
-		# change jail to persistent ban and try again (1 persistent ticket):
-		self.jail.actions.setBanTime(-1)
-		tickets = self.db.getCurrentBans(jail=self.jail, forbantime=-1,
-			fromtime=MyTime.time() + MyTime.str2seconds("1year"))
-		self.assertEqual(len(tickets), 1)
-		self.assertEqual(tickets[0].getBanTime(), -1); # current jail ban time.
+		self.assertEqual(len(tickets), 2)

 	def testActionWithDB(self):
 		# test action together with database functionality
 		self.testAddJail() # Jail required
 		self.jail.database = self.db
 		self.db.addJail(self.jail)
-		actions = self.jail.actions
+		actions = Actions(self.jail)
 		actions.add(
 			"action_checkainfo",
 			os.path.join(TEST_FILES_DIR, "action.d/action_checkainfo.py"),
 			{})
-		actions.banManager.setBanTotal(20)
-		self.jail._Jail__filter = flt = Filter(self.jail)
-		flt.failManager.setFailTotal(50)
-		ticket = FailTicket("1.2.3.4")
+		ticket = FailTicket("1.2.3.4", MyTime.time(), ['test', 'test'])
 		ticket.setAttempt(5)
-		ticket.setMatches(['test', 'test'])
 		self.jail.putFailTicket(ticket)
 		actions._Actions__checkBan()
 		self.assertLogged("ban ainfo %s, %s, %s, %s" % (True, True, True, True))
-		self.assertLogged("jail info %d, %d, %d, %d" % (1, 21, 0, 50))

 	def testDelAndAddJail(self):
 		self.testAddJail() # Add jail
@@ -516,9 +516,6 @@ class CustomDateFormatsTest(unittest.TestCase):
 			(1072746123.0 - 3600, "{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %Z)?", "[2003-12-30 01:02:03] server ..."),
 			(1072746123.0,        "{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %z)?", "[2003-12-30 01:02:03 UTC] server ..."),
 			(1072746123.0,        "{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %Z)?", "[2003-12-30 01:02:03 UTC] server ..."),
-			(1072746123.0,        "{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %z)?", "[2003-12-30 01:02:03 Z] server ..."),
-			(1072746123.0,        "{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %z)?", "[2003-12-30 01:02:03 +0000] server ..."),
-			(1072746123.0,        "{^LN-BEG}%ExY-%Exm-%Exd %ExH:%ExM:%ExS(?: %Z)?", "[2003-12-30 01:02:03 Z] server ..."),
 		):
 			logSys.debug('== test: %r', (matched, dp, line))
 			if dp is None:
@@ -28,19 +28,14 @@ from ..server.jail import Jail
 from ..server.actions import Actions


-class DummyActions(Actions):
-	def checkBan(self):
-		return self._Actions__checkBan()
-
-
 class DummyJail(Jail):
 	"""A simple 'jail' to suck in all the tickets generated by Filter's
 	"""
-	def __init__(self, name='DummyJail', backend=None):
+	def __init__(self, backend=None):
 		self.lock = Lock()
 		self.queue = []
-		super(DummyJail, self).__init__(name=name, backend=backend)
-		self.__actions = DummyActions(self)
+		super(DummyJail, self).__init__(name='DummyJail', backend=backend)
+		self.__actions = Actions(self)

 	def __len__(self):
 		with self.lock:
@@ -69,6 +64,10 @@ class DummyJail(Jail):
 			except IndexError:
 				return False

+	@property
+	def name(self):
+		return "DummyJail" + ("" if self.database else " #%s with %d tickets" % (id(self), len(self)))
+
 	@property
 	def idle(self):
 		return False;
@@ -44,7 +44,7 @@ from ..server import server
 from ..server.mytime import MyTime
 from ..server.utils import Utils
 from .utils import LogCaptureTestCase, logSys as DefLogSys, with_tmpdir, shutil, logging, \
-	STOCK, CONFIG_DIR as STOCK_CONF_DIR, TEST_NOW, tearDownMyTime
+	STOCK, CONFIG_DIR as STOCK_CONF_DIR

 from ..helpers import getLogger

@@ -78,35 +78,6 @@ fail2banclient.output = \
 fail2banserver.output = \
 protocol.output = _test_output

-def _time_shift(shift):
-	# jump to the future (+shift minutes):
-	logSys.debug("===>>> time shift + %s min", shift)
-	MyTime.setTime(MyTime.time() + shift*60)
-
-
-Observers = server.Observers
-
-def _observer_wait_idle():
-	"""Helper to wait observer becomes idle"""
-	if Observers.Main is not None:
-		Observers.Main.wait_empty(MID_WAITTIME)
-		Observers.Main.wait_idle(MID_WAITTIME / 5)
-
-def _observer_wait_before_incrban(cond, timeout=MID_WAITTIME):
-	"""Helper to block observer before increase bantime until some condition gets true"""
-	if Observers.Main is not None:
-		# switch ban handler:
-		_obs_banFound = Observers.Main.banFound
-		def _banFound(*args, **kwargs):
-			# restore original handler:
-			Observers.Main.banFound = _obs_banFound
-			# wait for:
-			logSys.debug('  [Observer::banFound] *** observer blocked for test')
-			Utils.wait_for(cond, timeout)
-			logSys.debug('  [Observer::banFound] +++ observer runs again')
-			# original banFound:
-			_obs_banFound(*args, **kwargs)
-		Observers.Main.banFound = _banFound

 #
 # Mocking .exit so we could test its correct operation.
@@ -230,7 +201,7 @@ def _start_params(tmp, use_stock=False, use_stock_cfg=None,
 			os.symlink(os.path.abspath(pjoin(STOCK_CONF_DIR, n)), pjoin(cfg, n))
 	if create_before_start:
 		for n in create_before_start:
-			_write_file(n % {'tmp': tmp}, 'w')
+			_write_file(n % {'tmp': tmp}, 'w', '')
 	# parameters (sock/pid and config, increase verbosity, set log, etc.):
 	vvv, llev = (), "INFO"
 	if unittest.F2B.log_level < logging.INFO: # pragma: no cover
@@ -343,7 +314,6 @@ def with_foreground_server_thread(startextra={}):
 				# to wait for end of server, default accept any exit code, because multi-threaded, 
 				# thus server can exit in-between...
 				def _stopAndWaitForServerEnd(code=(SUCCESS, FAILED)):
-					tearDownMyTime()
 					# if seems to be down - try to catch end phase (wait a bit for end:True to recognize down state):
 					if not phase.get('end', None) and not os.path.exists(pjoin(tmp, "f2b.pid")):
 						Utils.wait_for(lambda: phase.get('end', None) is not None, MID_WAITTIME)
@@ -383,7 +353,6 @@ def with_foreground_server_thread(startextra={}):
 					# so don't kill (same process) - if success, just wait for end of worker:
 					if phase.get('end', None):
 						th.join()
-				tearDownMyTime()
 		return wrapper
 	return _deco_wrapper

@@ -410,7 +379,6 @@ class Fail2banClientServerBase(LogCaptureTestCase):
 		server.DEF_LOGTARGET = SRV_DEF_LOGTARGET
 		server.DEF_LOGLEVEL = SRV_DEF_LOGLEVEL
 		LogCaptureTestCase.tearDown(self)
-		tearDownMyTime()

 	@staticmethod
 	def _test_exit(code=0):
@@ -478,14 +446,14 @@ class Fail2banClientServerBase(LogCaptureTestCase):

 	@with_foreground_server_thread(startextra={'f2b_local':(
 			"[Thread]",
-			"stacksize = 128"
+			"stacksize = 32"
 			"",
 		)})
 	def testStartForeground(self, tmp, startparams):
 		# check thread options were set:
 		self.pruneLog()
 		self.execCmd(SUCCESS, startparams, "get", "thread")
-		self.assertLogged("{'stacksize': 128}")
+		self.assertLogged("{'stacksize': 32}")
 		# several commands to server:
 		self.execCmd(SUCCESS, startparams, "ping")
 		self.execCmd(FAILED, startparams, "~~unknown~cmd~failed~~")
@@ -937,8 +905,10 @@ class Fail2banServerTest(Fail2banClientServerBase):
 			"Jail 'broken-jail' skipped, because of wrong configuration", all=True)
 		
 		# enable both jails, 3 logs for jail1, etc...
+		# truncate test-log - we should not find unban/ban again by reload:
 		self.pruneLog("[test-phase 1b]")
 		_write_jail_cfg(actions=[1,2])
+		_write_file(test1log, "w+")
 		if unittest.F2B.log_level < logging.DEBUG: # pragma: no cover
 			_out_file(test1log)
 		self.execCmd(SUCCESS, startparams, "reload")
@@ -1001,7 +971,7 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		
 		self.pruneLog("[test-phase 2b]")
 		# write new failures:
-		_write_file(test2log, "a+", *(
+		_write_file(test2log, "w+", *(
 			(str(int(MyTime.time())) + "   error 403 from 192.0.2.2: test 2",) * 3 +
 		  (str(int(MyTime.time())) + "   error 403 from 192.0.2.3: test 2",) * 3 +
 		  (str(int(MyTime.time())) + " failure 401 from 192.0.2.4: test 2",) * 3 +
@@ -1033,8 +1003,6 @@ class Fail2banServerTest(Fail2banClientServerBase):
 			"[test-jail2] Found 192.0.2.3", 
 			"[test-jail2] Ban 192.0.2.3", 
 			all=True)
-		# if observer available wait for it becomes idle (write all tickets to db):
-		_observer_wait_idle()
 		# test banned command:
 		self.assertSortedEqual(self.execCmdDirect(startparams,
 			'banned'), (0, [
@@ -1060,6 +1028,10 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		self.assertEqual(self.execCmdDirect(startparams,
 			'get', 'test-jail1', 'banned', '192.0.2.3', '192.0.2.9')[1],  [1, 0])

+		# rotate logs:
+		_write_file(test1log, "w+")
+		_write_file(test2log, "w+")
+
 		# restart jail without unban all:
 		self.pruneLog("[test-phase 2c]")
 		self.execCmd(SUCCESS, startparams,
@@ -1100,17 +1072,6 @@ class Fail2banServerTest(Fail2banClientServerBase):
 			"stdout: '[test-jail2] test-action3: ++ ban 192.0.2.22",
 			"stdout: '[test-jail2] test-action3: ++ ban 192.0.2.22 ", all=True, wait=MID_WAITTIME)

-		# get banned ips:
-		_observer_wait_idle()
-		self.pruneLog("[test-phase 2d.1]")
-		self.execCmd(SUCCESS, startparams, "get", "test-jail2", "banip", "\n")
-		self.assertLogged(
-			"192.0.2.4", "192.0.2.8", "192.0.2.21", "192.0.2.22", all=True, wait=MID_WAITTIME)
-		self.pruneLog("[test-phase 2d.2]")
-		self.execCmd(SUCCESS, startparams, "get", "test-jail1", "banip")
-		self.assertLogged(
-			"192.0.2.1", "192.0.2.2", "192.0.2.3", "192.0.2.4", "192.0.2.8", all=True, wait=MID_WAITTIME)
-
 		# restart jail with unban all:
 		self.pruneLog("[test-phase 2e]")
 		self.execCmd(SUCCESS, startparams,
@@ -1177,7 +1138,7 @@ class Fail2banServerTest(Fail2banClientServerBase):

 		# now write failures again and check already banned (jail1 was alive the whole time) and new bans occurred (jail1 was alive the whole time):
 		self.pruneLog("[test-phase 5]")
-		_write_file(test1log, "a+", *(
+		_write_file(test1log, "w+", *(
 			(str(int(MyTime.time())) + " failure 401 from 192.0.2.1: test 5",) * 3 + 
 			(str(int(MyTime.time())) + "   error 403 from 192.0.2.5: test 5",) * 3 +
 			(str(int(MyTime.time())) + " failure 401 from 192.0.2.6: test 5",) * 3
@@ -1328,7 +1289,7 @@ class Fail2banServerTest(Fail2banClientServerBase):
 			'failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>',
 			'maxretry = 1', # ban by first failure
 			'enabled = true',
-	  )
+		)
 	})
 	def testServerActions_NginxBlockMap(self, tmp, startparams):
 		cfg = pjoin(tmp, "config")
@@ -1404,9 +1365,8 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		'jails': (
 			# default:
 			'''test_action = dummy[actionstart_on_demand=1, init="start: %(__name__)s", target="%(tmp)s/test.txt",
-      actionban='<known/actionban>; echo "found: <jail.found> / <jail.found_total>, banned: <jail.banned> / <jail.banned_total>"
-        echo "<matches>"; printf "=====\\n%%b\\n=====\\n\\n" "<matches>" >> <target>',
-      actionstop='<known/actionstop>; echo "stats <name> - found: <jail.found_total>, banned: <jail.banned_total>"']''',
+      actionban='<known/actionban>;
+        echo "<matches>"; printf "=====\\n%%b\\n=====\\n\\n" "<matches>" >> <target>']''',
 			# jail sendmail-auth:
 			'[sendmail-auth]',
 			'backend = polling',
@@ -1451,8 +1411,7 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		_write_file(lgfn, "w+", *smaut_msg)
 		# wait and check it caused banned (and dump in the test-file):
 		self.assertLogged(
-			"[sendmail-auth] Ban 192.0.2.1",  "stdout: 'found: 0 / 3, banned: 1 / 1'",
-			"1 ticket(s) in 'sendmail-auth'", all=True, wait=MID_WAITTIME)
+			"[sendmail-auth] Ban 192.0.2.1", "1 ticket(s) in 'sendmail-auth'", all=True, wait=MID_WAITTIME)
 		_out_file(tofn)
 		td = _read_file(tofn)
 		# check matches (maxmatches = 2, so only 2 & 3 available):
@@ -1463,11 +1422,10 @@ class Fail2banServerTest(Fail2banClientServerBase):

 		self.pruneLog("[test-phase sendmail-reject]")
 		# write log:
-		_write_file(lgfn, "a+", *smrej_msg)
+		_write_file(lgfn, "w+", *smrej_msg)
 		# wait and check it caused banned (and dump in the test-file):
 		self.assertLogged(
-			"[sendmail-reject] Ban 192.0.2.2", "stdout: 'found: 0 / 3, banned: 1 / 1'",
-			"1 ticket(s) in 'sendmail-reject'", all=True, wait=MID_WAITTIME)
+			"[sendmail-reject] Ban 192.0.2.2", "1 ticket(s) in 'sendmail-reject'", all=True, wait=MID_WAITTIME)
 		_out_file(tofn)
 		td = _read_file(tofn)
 		# check matches (no maxmatches, so all matched messages are available):
@@ -1481,8 +1439,6 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		# wait a bit:
 		self.assertLogged(
 			"Reload finished.",
-			"stdout: 'stats sendmail-auth - found: 3, banned: 1'",
-			"stdout: 'stats sendmail-reject - found: 3, banned: 1'",
 			"[sendmail-auth] Restore Ban 192.0.2.1", "1 ticket(s) in 'sendmail-auth'", all=True, wait=MID_WAITTIME)
 		# check matches again - (dbmaxmatches = 1), so it should be only last match after restart:
 		td = _read_file(tofn)
@@ -1510,152 +1466,6 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		# just to debug actionstop:
 		self.assertFalse(exists(tofn))

-	@with_foreground_server_thread()
-	def testServerObserver(self, tmp, startparams):
-		cfg = pjoin(tmp, "config")
-		test1log = pjoin(tmp, "test1.log")
-
-		os.mkdir(pjoin(cfg, "action.d"))
-		def _write_action_cfg(actname="test-action1", prolong=True):
-			fn = pjoin(cfg, "action.d", "%s.conf" % actname)
-			_write_file(fn, "w",
-				"[DEFAULT]",
-				"",
-				"[Definition]",
-				"actionban =     printf %%s \"[%(name)s] %(actname)s: ++ ban <ip> -c <bancount> -t <bantime> : <F-MSG>\"", \
-				"actionprolong = printf %%s \"[%(name)s] %(actname)s: ++ prolong <ip> -c <bancount> -t <bantime> : <F-MSG>\"" \
-					if prolong else "",
-				"actionunban =   printf %%b '[%(name)s] %(actname)s: -- unban <ip>'",
-			)
-			if unittest.F2B.log_level <= logging.DEBUG: # pragma: no cover
-				_out_file(fn)
-
-		def _write_jail_cfg(backend="polling"):
-			_write_file(pjoin(cfg, "jail.conf"), "w",
-				"[INCLUDES]", "",
-				"[DEFAULT]", "",
-				"usedns = no",
-				"maxretry = 3",
-				"findtime = 1m",
-				"bantime = 5m",
-				"bantime.increment = true",
-				"datepattern = {^LN-BEG}EPOCH",
-				"",
-				"[test-jail1]", "backend = " + backend, "filter =", 
-				"action = test-action1[name='%(__name__)s']",
-				"         test-action2[name='%(__name__)s']",
-				"logpath = " + test1log,
-				r"failregex = ^\s*failure <F-ERRCODE>401|403</F-ERRCODE> from <HOST>:\s*<F-MSG>.*</F-MSG>$",
-				"enabled = true",
-				"",
-			)
-			if unittest.F2B.log_level <= logging.DEBUG: # pragma: no cover
-				_out_file(pjoin(cfg, "jail.conf"))
-
-		# create test config:
-		_write_action_cfg(actname="test-action1", prolong=False)
-		_write_action_cfg(actname="test-action2", prolong=True)
-		_write_jail_cfg()
-
-		_write_file(test1log, "w")
-		# initial start:
-		self.pruneLog("[test-phase 0) time-0]")
-		self.execCmd(SUCCESS, startparams, "reload")
-		# generate bad ip:
-		_write_file(test1log, "w+", *(
-		  (str(int(MyTime.time())) + " failure 401 from 192.0.2.11: I'm bad \"hacker\" `` $(echo test)",) * 3
-		))
-		# wait for ban:
-		_observer_wait_idle()
-		self.assertLogged(
-			"stdout: '[test-jail1] test-action1: ++ ban 192.0.2.11 -c 1 -t 300 : ",
-			"stdout: '[test-jail1] test-action2: ++ ban 192.0.2.11 -c 1 -t 300 : ",
-			all=True, wait=MID_WAITTIME)
-		# wait for observer idle (write all tickets to db):
-		_observer_wait_idle()
-
-		self.pruneLog("[test-phase 1) time+10m]")
-		# jump to the future (+10 minutes):
-		_time_shift(10)
-		_observer_wait_idle()
-		self.assertLogged(
-			"stdout: '[test-jail1] test-action1: -- unban 192.0.2.11",
-			"stdout: '[test-jail1] test-action2: -- unban 192.0.2.11",
-			"0 ticket(s) in 'test-jail1'",
-			all=True, wait=MID_WAITTIME)
-		_observer_wait_idle()
-
-		self.pruneLog("[test-phase 2) time+10m]")
-		# following tests are time-related - observer can prolong ticket (increase ban-time) 
-		# before banning, so block it here before banFound called, prolong case later:
-		wakeObs = False
-		_observer_wait_before_incrban(lambda: wakeObs)
-		# write again (IP already bad):
-		_write_file(test1log, "a+", *(
-		  (str(int(MyTime.time())) + " failure 401 from 192.0.2.11: I'm very bad \"hacker\" `` $(echo test)",) * 2
-		))
-		# wait for ban:
-		self.assertLogged(
-			"stdout: '[test-jail1] test-action1: ++ ban 192.0.2.11 -c 2 -t 300 : ",
-			"stdout: '[test-jail1] test-action2: ++ ban 192.0.2.11 -c 2 -t 300 : ",
-			all=True, wait=MID_WAITTIME)
-		# get banned ips with time:
-		self.pruneLog("[test-phase 2) time+10m - get-ips]")
-		self.execCmd(SUCCESS, startparams, "get", "test-jail1", "banip", "--with-time")
-		self.assertLogged(
-			"192.0.2.11", "+ 300 =", all=True, wait=MID_WAITTIME)
-		# unblock observer here and wait it is done:
-		wakeObs = True
-		_observer_wait_idle()
-
-		self.pruneLog("[test-phase 2) time+11m]")
-		# jump to the future (+1 minute):
-		_time_shift(1)
-		# wait for observer idle (write all tickets to db):
-		_observer_wait_idle()
-		# wait for prolong:
-		self.assertLogged(
-			"stdout: '[test-jail1] test-action2: ++ prolong 192.0.2.11 -c 2 -t 600 : ",
-			all=True, wait=MID_WAITTIME)
-
-		# get banned ips with time:
-		_observer_wait_idle()
-		self.pruneLog("[test-phase 2) time+11m - get-ips]")
-		self.execCmd(SUCCESS, startparams, "get", "test-jail1", "banip", "--with-time")
-		self.assertLogged(
-			"192.0.2.11", "+ 600 =", all=True, wait=MID_WAITTIME)
-
-		# test stop with busy observer:
-		self.pruneLog("[test-phase end) stop on busy observer]")
-		tearDownMyTime()
-		a = {'state': 0}
-		obsMain = Observers.Main
-		def _long_action():
-			logSys.info('++ observer enters busy state ...')
-			a['state'] = 1
-			Utils.wait_for(lambda: a['state'] == 2, MAX_WAITTIME)
-			obsMain.db_purge(); # does nothing (db is already None)
-			logSys.info('-- observer leaves busy state.')
-		obsMain.add('call', _long_action)
-		obsMain.add('call', lambda: None)
-		# wait observer enter busy state:
-		Utils.wait_for(lambda: a['state'] == 1, MAX_WAITTIME)
-		# overwrite default wait time (normally 5 seconds):
-		obsMain_stop = obsMain.stop
-		def _stop(wtime=(0.01 if unittest.F2B.fast else 0.1), forceQuit=True):
-			return obsMain_stop(wtime, forceQuit)
-		obsMain.stop = _stop
-		# stop server and wait for end:
-		self.stopAndWaitForServerEnd(SUCCESS)
-		# check observer and db state:
-		self.assertNotLogged('observer leaves busy state')
-		self.assertFalse(obsMain.idle)
-		self.assertEqual(obsMain._ObserverThread__db, None)
-		# server is exited without wait for observer, stop it now:
-		a['state'] = 2
-		self.assertLogged('observer leaves busy state', wait=True)
-		obsMain.join()
-
 	# test multiple start/stop of the server (threaded in foreground) --
 	if False: # pragma: no cover
 		@with_foreground_server_thread()
@@ -1666,4 +1476,3 @@ class Fail2banServerTest(Fail2banClientServerBase):
 		def testServerStartStop(self):
 			for i in xrange(2000):
 				self._testServerStartStop()
-
@@ -25,7 +25,6 @@ __license__ = "GPL"

 import os
 import sys
-import tempfile
 import unittest

 from ..client import fail2banregex
@@ -81,11 +80,6 @@ def _test_exec_command_line(*args):
 		sys.stderr = _org['stderr']
 	return _exit_code

-def _reset():
-	# reset global warn-counter:
-	from ..server.filter import _decode_line_warn
-	_decode_line_warn.clear()
-
 STR_00 = "Dec 31 11:59:59 [sshd] error: PAM: Authentication failure for kevin from 192.0.2.0"
 STR_00_NODT = "[sshd] error: PAM: Authentication failure for kevin from 192.0.2.0"

@@ -128,7 +122,6 @@ class Fail2banRegexTest(LogCaptureTestCase):
 		"""Call before every test case."""
 		LogCaptureTestCase.setUp(self)
 		setUpMyTime()
-		_reset()

 	def tearDown(self):
 		"""Call after every test case."""
@@ -354,23 +347,6 @@ class Fail2banRegexTest(LogCaptureTestCase):
 		self.assertTrue(_test_exec('-o', 'id', STR_00, RE_00_ID))
 		self.assertLogged('kevin')
 		self.pruneLog()
-		# multiple id combined to a tuple (id, tuple_id):
-		self.assertTrue(_test_exec('-o', 'id', 
-			'1591983743.667 192.0.2.1 192.0.2.2',
-			r'^\s*<F-ID/> <F-TUPLE_ID>\S+</F-TUPLE_ID>'))
-		self.assertLogged(str(('192.0.2.1', '192.0.2.2')))
-		self.pruneLog()
-		# multiple id combined to a tuple, id first - (id, tuple_id_1, tuple_id_2):
-		self.assertTrue(_test_exec('-o', 'id', 
-			'1591983743.667 left 192.0.2.3 right',
-			r'^\s*<F-TUPLE_ID_1>\S+</F-TUPLE_ID_1> <F-ID/> <F-TUPLE_ID_2>\S+</F-TUPLE_ID_2>'))
-		self.pruneLog()
-		# id had higher precedence as ip-address:
-		self.assertTrue(_test_exec('-o', 'id', 
-			'1591983743.667 left [192.0.2.4]:12345 right',
-			r'^\s*<F-TUPLE_ID_1>\S+</F-TUPLE_ID_1> <F-ID><ADDR>:<F-PORT/></F-ID> <F-TUPLE_ID_2>\S+</F-TUPLE_ID_2>'))
-		self.assertLogged(str(('[192.0.2.4]:12345', 'left', 'right')))
-		self.pruneLog()
 		# row with id :
 		self.assertTrue(_test_exec('-o', 'row', STR_00, RE_00_ID))
 		self.assertLogged("['kevin'", "'ip4': '192.0.2.0'", "'fid': 'kevin'", all=True)
@@ -471,8 +447,14 @@ class Fail2banRegexTest(LogCaptureTestCase):
 			FILENAME_ZZZ_GEN, FILENAME_ZZZ_GEN
 		))

+	def _reset(self):
+		# reset global warn-counter:
+		from ..server.filter import _decode_line_warn
+		_decode_line_warn.clear()
+
 	def testWronChar(self):
 		unittest.F2B.SkipIfCfgMissing(stock=True)
+		self._reset()
 		self.assertTrue(_test_exec(
 		"-l", "notice", # put down log-level, because of too many debug-messages
 			"--datepattern", r"^(?:%a )?%b %d %H:%M:%S(?:\.%f)?(?: %ExY)?",
@@ -488,6 +470,7 @@ class Fail2banRegexTest(LogCaptureTestCase):

 	def testWronCharDebuggex(self):
 		unittest.F2B.SkipIfCfgMissing(stock=True)
+		self._reset()
 		self.assertTrue(_test_exec(
 		"-l", "notice", # put down log-level, because of too many debug-messages
 			"--datepattern", r"^(?:%a )?%b %d %H:%M:%S(?:\.%f)?(?: %ExY)?",
@@ -500,36 +483,6 @@ class Fail2banRegexTest(LogCaptureTestCase):

 		self.assertLogged('https://')

-	def testNLCharAsPartOfUniChar(self):
-		fname = tempfile.mktemp(prefix='tmp_fail2ban', suffix='uni')
-		# test two multi-byte encodings (both contains `\x0A` in either \x02\x0A or \x0A\x02):
-		for enc in ('utf-16be', 'utf-16le'):
-			self.pruneLog("[test-phase encoding=%s]" % enc)
-			try:
-				fout = open(fname, 'wb')
-				# test on unicode string containing \x0A as part of uni-char,
-				# it must produce exactly 2 lines (both are failures):
-				for l in (
-					u'1490349000 \u20AC Failed auth: invalid user Test\u020A from 192.0.2.1\n',
-					u'1490349000 \u20AC Failed auth: invalid user TestI from 192.0.2.2\n'
-				):
-					fout.write(l.encode(enc))
-				fout.close()
-
-				self.assertTrue(_test_exec(
-				"-l", "notice", # put down log-level, because of too many debug-messages
-					"--encoding", enc,
-					"--datepattern", r"^EPOCH",
-					fname, r"Failed .* from <HOST>",
-				))
-
-				self.assertLogged(" encoding : %s" % enc,
-					"Lines: 2 lines, 0 ignored, 2 matched, 0 missed", all=True)
-				self.assertNotLogged("Missed line(s)")
-			finally:
-				fout.close()
-				os.unlink(fname)
-
 	def testExecCmdLine_Usage(self):
 		self.assertNotEqual(_test_exec_command_line(), 0)
 		self.pruneLog()
@@ -159,10 +159,10 @@ class AddFailure(unittest.TestCase):
 		ticket_repr = repr(ticket)
 		self.assertEqual(
 			ticket_str,
-			'FailTicket: ip=193.168.0.128 time=1167605999.0 bantime=None bancount=0 #attempts=5 matches=[]')
+			'FailTicket: ip=193.168.0.128 time=1167605999.0 #attempts=5 matches=[]')
 		self.assertEqual(
 			ticket_repr,
-			'FailTicket: ip=193.168.0.128 time=1167605999.0 bantime=None bancount=0 #attempts=5 matches=[]')
+			'FailTicket: ip=193.168.0.128 time=1167605999.0 #attempts=5 matches=[]')
 		self.assertFalse(not ticket)
 		# and some get/set-ers otherwise not tested
 		ticket.setTime(1000002000.0)
@@ -170,7 +170,7 @@ class AddFailure(unittest.TestCase):
 		# and str() adjusted correspondingly
 		self.assertEqual(
 			str(ticket),
-			'FailTicket: ip=193.168.0.128 time=1000002000.0 bantime=None bancount=0 #attempts=5 matches=[]')
+			'FailTicket: ip=193.168.0.128 time=1000002000.0 #attempts=5 matches=[]')
 	
 	def testbanNOK(self):
 		self._addDefItems()
@@ -8,9 +8,6 @@ class TestAction(ActionBase):
        self._logSys.info("ban ainfo %s, %s, %s, %s",
          aInfo["ipmatches"] != '', aInfo["ipjailmatches"] != '', aInfo["ipfailures"] > 0, aInfo["ipjailfailures"] > 0
        )
-        self._logSys.info("jail info %d, %d, %d, %d",
-          aInfo["jail.banned"], aInfo["jail.banned_total"], aInfo["jail.found"], aInfo["jail.found_total"]
-        )

    def unban(self, aInfo):
        pass
@@ -19,8 +19,6 @@
 [2012-02-13 17:44:26] NOTICE[1638] chan_iax2.c: Host 1.2.3.4 failed MD5 authentication for 'Fail2ban' (e7df7cd2ca07f4f1ab415d457a6e1c13 != 53ac4bc41ee4ec77888ed4aa50677247)
 # failJSON: { "time": "2013-02-05T23:44:42", "match": true , "host": "1.2.3.4" }
 [2013-02-05 23:44:42] NOTICE[436][C-00000fa9] chan_sip.c: Call from '' (1.2.3.4:10836) to extension '0972598285108' rejected because extension not found in context 'default'.
-# failJSON: { "time": "2005-01-18T17:39:50", "match": true , "host": "1.2.3.4" }
-[Jan 18 17:39:50] NOTICE[12049]: res_pjsip_session.c:2337 new_invite: Call from 'anonymous' (TCP:[1.2.3.4]:61470) to extension '9011+442037690237' rejected because extension not found in context 'default'.
 # failJSON: { "time": "2013-03-26T15:47:54", "match": true , "host": "1.2.3.4" }
 [2013-03-26 15:47:54] NOTICE[1237] chan_sip.c: Registration from '"100"sip:100@1.2.3.4' failed for '1.2.3.4:23930' - No matching peer found
 # failJSON: { "time": "2013-05-13T07:10:53", "match": true , "host": "1.2.3.4" }
@@ -3,15 +3,5 @@ Apr 26 13:15:25 webserver example.com: https://example.com|1430068525|user|1.2.3
 # failJSON: { "time": "2005-04-26T13:15:25", "match": true , "host": "1.2.3.4" }
 Apr 26 13:15:25 webserver example.com: https://example.com/subdir|1430068525|user|1.2.3.4|https://example.com/subdir/user|https://example.com/subdir/user|0||Login attempt failed for drupaladmin.

-# failJSON: { "time": "2005-04-26T13:19:08", "match": false , "host": "1.2.3.4", "user": "drupaladmin" }
+# failJSON: { "time": "2005-04-26T13:19:08", "match": false , "host": "1.2.3.4" }
 Apr 26 13:19:08 webserver example.com: https://example.com|1430068748|user|1.2.3.4|https://example.com/user|https://example.com/user|1||Session opened for drupaladmin.
-
-# failJSON: { "time": "2005-04-26T13:20:00", "match": false, "desc": "attempt to inject on URI (pipe, login failed for), not a failure, gh-2742" }
-Apr 26 13:20:00 host drupal-site: https://example.com|1613063581|user|192.0.2.5|https://example.com/user/login?test=%7C&test2=%7C...|https://example.com/user/login?test=|&test2=|0||Login attempt failed for tester|2||Session revisited for drupaladmin.
-
-# failJSON: { "time": "2005-04-26T13:20:01", "match": true , "host": "192.0.2.7", "user": "Jack Sparrow", "desc": "log-format change - for -> from, user name with space, gh-2742" }
-Apr 26 13:20:01 mweb drupal_site[24864]: https://www.example.com|1613058599|user|192.0.2.7|https://www.example.com/en/user/login|https://www.example.com/en/user/login|0||Login attempt failed from Jack Sparrow.
-# failJSON: { "time": "2005-04-26T13:20:02", "match": true , "host": "192.0.2.4", "desc": "attempt to inject on URI (pipe), login failed, gh-2742" }
-Apr 26 13:20:02 host drupal-site: https://example.com|1613063581|user|192.0.2.4|https://example.com/user/login?test=%7C&test2=%7C|https://example.com/user/login?test=|&test2=||0||Login attempt failed from 192.0.2.4.
-# failJSON: { "time": "2005-04-26T13:20:03", "match": false, "desc": "attempt to inject on URI (pipe, login failed from), not a failure, gh-2742" }
-Apr 26 13:20:03 host drupal-site: https://example.com|1613063581|user|192.0.2.5|https://example.com/user/login?test=%7C&test2=%7C...|https://example.com/user/login?test=|&test2=|0||Login attempt failed from 1.2.3.4|2||Session revisited for drupaladmin.
@@ -1,7 +1,7 @@
 # Previous version --
-# failJSON: { "time": "2005-04-17T06:05:29", "match": true , "host": "69.93.127.111" }
+# failJSON: { "time": "2005-04-16T21:05:29", "match": true , "host": "69.93.127.111" }
 [PDT Apr 16 21:05:29] error    : Warning: Client '69.93.127.111' supplied unknown user 'foo' accessing monit httpd
-# failJSON: { "time": "2005-04-17T05:59:33", "match": true , "host": "97.113.189.111" }
+# failJSON: { "time": "2005-04-16T20:59:33", "match": true , "host": "97.113.189.111" }
 [PDT Apr 16 20:59:33] error    : Warning: Client '97.113.189.111' supplied wrong password for user 'admin' accessing monit httpd

 # Current version -- corresponding "https://bitbucket.org/tildeslash/monit/src/6905335aa903d425cae732cab766bd88ea5f2d1d/src/http/processor.c?at=master&fileviewer=file-view-default#processor.c-728"
@@ -1,8 +0,0 @@
-# failJSON: { "time": "2021-04-14T08:11:01", "match": false, "desc": "should be ignored: successful request" }
-Wed Apr 14 08:11:01 2021 - OK - [127.0.0.1] "GET /monitorix-cgi/monitorix.cgi - Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:87.0) Gecko/20100101 Firefox/87.0"
-# failJSON: { "time": "2021-04-14T08:54:22", "match": true, "host": "127.0.0.1", "desc": "file does not exist"  }
-Wed Apr 14 08:54:22 2021 - NOTEXIST - [127.0.0.1] File does not exist: /manager/html
-# failJSON: { "time": "2021-04-14T11:24:31", "match": true, "host": "127.0.0.1", "desc": "access not allowed"  }
-Wed Apr 14 11:24:31 2021 - NOTALLOWED - [127.0.0.1] Access not allowed: /monitorix/
-# failJSON: { "time": "2021-04-14T11:26:08", "match": true, "host": "127.0.0.1", "desc": "authentication error"  }
-Wed Apr 14 11:26:08 2021 - AUTHERR - [127.0.0.1] Authentication error: /monitorix/
@@ -1,11 +0,0 @@
-# failJSON: { "time": "2020-02-24T16:05:21", "match": true , "host": "192.0.2.1" }
-2020-02-24 16:05:21.00 Logon       Login failed for user 'Backend'. Reason: Could not find a login matching the name provided. [CLIENT: 192.0.2.1]
-# failJSON: { "time": "2020-02-24T16:30:25", "match": true , "host": "192.0.2.2" }
-2020-02-24 16:30:25.88 Logon       Login failed for user '===)jf02hüas9ä##22f'. Reason: Could not find a login matching the name provided. [CLIENT: 192.0.2.2]
-# failJSON: { "time": "2020-02-24T16:31:12", "match": true , "host": "192.0.2.3" }
-2020-02-24 16:31:12.20 Logon       Login failed for user ''. Reason: An attempt to login using SQL authentication failed. Server is configured for Integrated authentication only. [CLIENT: 192.0.2.3]
-
-# failJSON: { "time": "2020-02-24T16:31:26", "match": true , "host": "192.0.2.4", "user":"O'Leary" }
-2020-02-24 16:31:26.01 Logon       Login failed for user 'O'Leary'. Reason: Could not find a login matching the name provided. [CLIENT: 192.0.2.4]
-# failJSON: { "time": "2020-02-24T16:31:26", "match": false, "desc": "test injection in possibly unescaped foreign input" }
-2020-02-24 16:31:26.02 Wrong data received: Logon       Login failed for user 'test'. Reason: Could not find a login matching the name provided. [CLIENT: 192.0.2.5]
@@ -1,23 +0,0 @@
-# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" }
-12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "" 400 47 "-" "-" "-"
-
-# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" }
-12.34.56.78 - root [20/Jan/2015:19:53:28 +0100] "" 400 47 "-" "-" "-"
-
-# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" }
-12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 47 "-" "-" "-"
-
-# failJSON: { "time": "2015-01-20T19:53:28", "match": true , "host": "12.34.56.78" }
-12.34.56.78 - - [20/Jan/2015:19:53:28 +0100] "GET //admin/pma/scripts/setup.php HTTP/1.1" 400 47 "-" "-" "-"
-
-# failJSON: { "time": "2015-01-20T19:54:28", "match": true , "host": "12.34.56.78" }
-12.34.56.78 - - [20/Jan/2015:19:54:28 +0100] "HELP" 400 47 "-" "-" "-"
-
-# failJSON: { "time": "2015-01-20T19:55:28", "match": true , "host": "12.34.56.78" }
-12.34.56.78 - - [20/Jan/2015:19:55:28 +0100] "batman" 400 47 "-" "-" "-"
-
-# failJSON: { "time": "2015-01-20T01:17:07", "match": true , "host": "7.8.9.10" }
-7.8.9.10 - root [20/Jan/2015:01:17:07 +0100] "CONNECT 123.123.123.123 HTTP/1.1" 400 162 "-" "-" "-"
-
-# failJSON: { "time": "2014-12-12T22:59:02", "match": true , "host": "2.5.2.5" }
-2.5.2.5 - tomcat [12/Dec/2014:22:59:02 +0100] "GET /cgi-bin/tools/tools.pl HTTP/1.1" 400 162 "-" "-" "-"
@@ -1,4 +1,3 @@
-# filterOptions: [{"mode": "normal"}, {"mode": "auth"}]

 # failJSON: { "time": "2012-04-09T11:53:29", "match": true , "host": "192.0.43.10" }
 2012/04/09 11:53:29 [error] 2865#0: *66647 user "xyz" was not found in "/var/www/.htpasswd", client: 192.0.43.10, server: www.myhost.com, request: "GET / HTTP/1.1", host: "www.myhost.com"
@@ -12,20 +11,3 @@
 2014/04/03 22:20:38 [error] 30708#0: *3 user "scriben dio": password mismatch, client: 192.0.2.1, server: , request: "GET / HTTP/1.1", host: "localhost:8443"
 # failJSON: { "time": "2014-04-03T22:20:40", "match": true, "host": "192.0.2.2", "desc": "trying injection on user name"}
 2014/04/03 22:20:40 [error] 30708#0: *3 user "test": password mismatch, client: 127.0.0.1, server: test, request: "GET / HTTP/1.1", host: "localhost:8443"": was not found in "/etc/nginx/.htpasswd", client: 192.0.2.2, server: , request: "GET / HTTP/1.1", host: "localhost:8443"
-
-# filterOptions: [{"mode": "fallback"}]
-
-# failJSON: { "time": "2020-11-25T14:42:16", "match": true , "host": "142.93.180.14" }
-2020/11/25 14:42:16 [crit] 76952#76952: *2454307 SSL_do_handshake() failed (SSL: error:1408F0C6:SSL routines:ssl3_get_record:packet length too long) while SSL handshaking, client: 142.93.180.14, server: 0.0.0.0:443
-# failJSON: { "time": "2020-11-25T15:47:47", "match": true , "host": "80.191.166.166" }
-2020/11/25 15:47:47 [crit] 76952#76952: *5062354 SSL_do_handshake() failed (SSL: error:1408F0A0:SSL routines:ssl3_get_record:length too short) while SSL handshaking, client: 80.191.166.166, server: 0.0.0.0:443
-# failJSON: { "time": "2020-11-25T16:48:08", "match": true , "host": "5.126.32.148" }
-2020/11/25 16:48:08 [crit] 76952#76952: *7976400 SSL_do_handshake() failed (SSL: error:1408F096:SSL routines:ssl3_get_record:encrypted length too long) while SSL handshaking, client: 5.126.32.148, server: 0.0.0.0:443
-# failJSON: { "time": "2020-11-25T16:02:45", "match": false }
-2020/11/25 16:02:45 [error] 76952#76952: *5645766 connect() failed (111: Connection refused) while connecting to upstream, client: 5.126.32.148, server: www.google.de, request: "GET /admin/config HTTP/2.0", upstream: "http://127.0.0.1:3000/admin/config", host: "www.google.de"
-
-# filterOptions: [{"mode": "aggressive"}]
-# failJSON: { "time": "2020-11-25T14:42:16", "match": true , "host": "142.93.180.14" }
-2020/11/25 14:42:16 [crit] 76952#76952: *2454307 SSL_do_handshake() failed (SSL: error:1408F0C6:SSL routines:ssl3_get_record:packet length too long) while SSL handshaking, client: 142.93.180.14, server: 0.0.0.0:443
-# failJSON: { "time": "2012-04-09T11:53:29", "match": true , "host": "192.0.43.10" }
-2012/04/09 11:53:29 [error] 2865#0: *66647 user "xyz" was not found in "/var/www/.htpasswd", client: 192.0.43.10, server: www.myhost.com, request: "GET / HTTP/1.1", host: "www.myhost.com"
@@ -2,5 +2,3 @@
 [1387288694] nsd[7745]: info: ratelimit block example.com. type any target 192.0.2.0/24 query 192.0.2.105 TYPE255
 # failJSON: { "time": "2013-12-18T07:42:15", "match": true , "host": "192.0.2.115" }
 [1387348935] nsd[23600]: info: axfr for zone domain.nl. from client 192.0.2.115 refused, no acl matches.
-# failJSON: { "time": "2021-03-05T05:25:14", "match": true , "host": "192.0.2.32", "desc": "new format, no client after from, no dot at end, gh-2965" }
-[2021-03-05 05:25:14.562] nsd[160800]: info: axfr for example.com. from 192.0.2.32 refused, no acl matches
@@ -15,9 +15,6 @@ Aug 10 10:55:38 f-vanier-bourgeois postfix/smtpd[2162]: NOQUEUE: reject: VRFY fr
 # failJSON: { "time": "2005-08-13T15:45:46", "match": true , "host": "192.0.2.1" }
 Aug 13 15:45:46 server postfix/smtpd[13844]: 00ADB3C0899: reject: RCPT from example.com[192.0.2.1]: 550 5.1.1 <sales@server.com>: Recipient address rejected: User unknown in local recipient table; from=<xxxxxx@example.com> to=<sales@server.com> proto=ESMTP helo=<mail.example.com>

-# failJSON: { "time": "2005-05-19T00:00:30", "match": true , "host": "192.0.2.2", "desc": "undeliverable address (sender/recipient verification, gh-3039)" }
-May 19 00:00:30 proxy2 postfix/smtpd[16123]: NOQUEUE: reject: RCPT from example.net[192.0.2.2]: 550 5.1.1 <user1@example.com>: Recipient address rejected: undeliverable address: verification failed; from=<user2@example.org> to=<user1@example.com> proto=ESMTP helo=<example.net>
-
 # failJSON: { "time": "2005-01-12T11:07:49", "match": true , "host": "181.21.131.88" }
 Jan 12 11:07:49 emf1pt2-2-35-70 postfix/smtpd[13767]: improper command pipelining after DATA from unknown[181.21.131.88]:

@@ -164,17 +161,6 @@ Feb 18 09:48:04 xxx postfix/smtpd[23]: lost connection after AUTH from unknown[1
 # failJSON: { "time": "2005-02-18T09:48:04", "match": true , "host": "192.0.2.23" }
 Feb 18 09:48:04 xxx postfix/smtpd[23]: lost connection after AUTH from unknown[192.0.2.23]

-# failJSON: { "time": "2004-12-23T19:39:13", "match": true , "host": "192.0.2.2" }
-Dec 23 19:39:13 xxx postfix/postscreen[21057]: PREGREET 14 after 0.08 from [192.0.2.2]:59415: EHLO ylmf-pc\r\n
-# failJSON: { "time": "2004-12-24T00:54:36", "match": true , "host": "192.0.2.3" }
-Dec 24 00:54:36 xxx postfix/postscreen[22515]: HANGUP after 16 from [192.0.2.3]:48119 in tests after SMTP handshake
-
-# failJSON: { "time": "2005-06-08T23:14:28", "match": true , "host": "192.0.2.77", "desc": "abusive clients hitting command limit, see see http://www.postfix.org/POSTSCREEN_README.html (gh-3040)" }
-Jun  8 23:14:28 proxy2 postfix/postscreen[473]: COMMAND TIME LIMIT from [192.0.2.77]:3608 after CONNECT
-# failJSON: { "time": "2005-06-08T23:14:54", "match": true , "host": "192.0.2.26", "desc": "abusive clients hitting command limit (gh-3040)" }
-Jun  8 23:14:54 proxy2 postfix/postscreen[473]: COMMAND COUNT LIMIT from [192.0.2.26]:15592 after RCPT
-
-
 # filterOptions: [{}, {"mode": "ddos"}, {"mode": "aggressive"}]
 # failJSON: { "match": false, "desc": "don't affect lawful data (sporadical connection aborts within DATA-phase, see gh-1813 for discussion)" }
 Feb 18 09:50:05 xxx postfix/smtpd[42]: lost connection after DATA from good-host.example.com[192.0.2.10]
@@ -1,8 +0,0 @@
-# failJSON: { "time": "2005-03-05T21:44:43", "match": true , "host": "192.0.2.123" } 
-Mar  5 21:44:43 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 80, 81, 83, 88, 99, 443, 1080, 3128, ..., f????uxy, TOS 00, TTL 49 @20:44:43
-# failJSON: { "time": "2005-03-05T21:44:44", "match": true , "host": "192.0.2.123" } 
-Mar  5 21:44:44 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 497, 515, 544, 543, 464, 513, ..., fSrpauxy, TOS 00 @09:04:25
-# failJSON: { "time": "2005-03-05T21:44:45", "match": true , "host": "192.0.2.123" } 
-Mar  5 21:44:45 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 593, 548, 636, 646, 625, 631, ..., fSrpauxy, TOS 00, TTL 239 @17:34:00
-# failJSON: { "time": "2005-03-05T21:44:46", "match": true , "host": "192.0.2.123" } 
-Mar  5 21:44:46 srv scanlogd: 192.0.2.123 to 192.0.2.1 ports 22, 26, 37, 80, 25, 79, ..., fSrpauxy, TOS 00 @22:38:37
@@ -1,8 +1,2 @@
 # failJSON: { "time": "2016-03-28T16:50:49", "match": true , "host": "10.1.1.1" }
 [Mon Mar 28 16:50:49.522240 2016] [:error] [pid 1795] [client 10.1.1.1:50700] WAR [Login denied for user "username1"], referer: https://zoneminder/
-
-# failJSON: { "time": "2021-03-28T16:53:00", "match": true , "host": "10.1.1.1" }
-[Sun Mar 28 16:53:00.472693 2021] [php7:notice] [pid 11328] [client 10.1.1.1:39568] ERR [Could not retrieve user username1 details], referer: https://zm/zm/?view=logout
-
-# failJSON: { "time": "2021-03-28T16:59:14", "match": true , "host": "10.1.1.1" }
-[Sun Mar 28 16:59:14.150625 2021] [php7:notice] [pid 11336] [client 10.1.1.1:39654] ERR [Login denied for user "username1"], referer: https://zm/zm/?
@@ -92,7 +92,7 @@ class _tmSerial():
 	@staticmethod
 	def _tm(time):
 		# ## strftime it too slow for large time serializer :
-		# return MyTime.time2str(time)
+		# return datetime.datetime.fromtimestamp(time).strftime("%Y-%m-%d %H:%M:%S")
 		c = _tmSerial
 		sec = (time % 60)
 		if c._last_s == time - sec:
@@ -196,7 +196,7 @@ def _assert_correct_last_attempt(utest, filter_, output, count=None):
 			_assert_equal_entries(utest, f, o)


-def _copy_lines_between_files(in_, fout, n=None, skip=0, mode='a', terminal_line="", lines=None):
+def _copy_lines_between_files(in_, fout, n=None, skip=0, mode='a', terminal_line=""):
 	"""Copy lines from one file to another (which might be already open)

 	Returns open fout
@@ -213,9 +213,9 @@ def _copy_lines_between_files(in_, fout, n=None, skip=0, mode='a', terminal_line
 		fin.readline()
 	# Read
 	i = 0
-	if not lines: lines = []
+	lines = []
 	while n is None or i < n:
-		l = fin.readline().decode('UTF-8', 'replace').rstrip('\r\n')
+		l = FileContainer.decode_line(in_, 'UTF-8', fin.readline()).rstrip('\r\n')
 		if terminal_line is not None and l == terminal_line:
 			break
 		lines.append(l)
@@ -223,7 +223,6 @@ def _copy_lines_between_files(in_, fout, n=None, skip=0, mode='a', terminal_line
 	# Write: all at once and flush
 	if isinstance(fout, str):
 		fout = open(fout, mode)
-	DefLogSys.debug('  ++ write %d test lines', len(lines))
 	fout.write('\n'.join(lines)+'\n')
 	fout.flush()
 	if isinstance(in_, str): # pragma: no branch - only used with str in test cases
@@ -255,7 +254,7 @@ def _copy_lines_to_journal(in_, fields={},n=None, skip=0, terminal_line=""): # p
 	# Read/Write
 	i = 0
 	while n is None or i < n:
-		l = fin.readline().decode('UTF-8', 'replace').rstrip('\r\n')
+		l = FileContainer.decode_line(in_, 'UTF-8', fin.readline()).rstrip('\r\n')
 		if terminal_line is not None and l == terminal_line:
 			break
 		journal.send(MESSAGE=l.strip(), **fields)
@@ -313,7 +312,7 @@ class BasicFilter(unittest.TestCase):
 		unittest.F2B.SkipIfFast()
 		## test function "_tm" works correct (returns the same as slow strftime):
 		for i in xrange(1417512352, (1417512352 // 3600 + 3) * 3600):
-			tm = MyTime.time2str(i)
+			tm = datetime.datetime.fromtimestamp(i).strftime("%Y-%m-%d %H:%M:%S")
 			if _tm(i) != tm: # pragma: no cover - never reachable
 				self.assertEqual((_tm(i), i), (tm, i))

@@ -671,19 +670,6 @@ class LogFile(LogCaptureTestCase):
 		self.filter = FilterPoll(None)
 		self.assertRaises(IOError, self.filter.addLogPath, LogFile.MISSING)

-	def testDecodeLineWarn(self):
-		# incomplete line (missing byte at end), warning is suppressed:
-		l = u"correct line\n"
-		r = l.encode('utf-16le')
-		self.assertEqual(FileContainer.decode_line('TESTFILE', 'utf-16le', r), l)
-		self.assertEqual(FileContainer.decode_line('TESTFILE', 'utf-16le', r[0:-1]), l[0:-1])
-		self.assertNotLogged('Error decoding line')
-		# complete line (incorrect surrogate in the middle), warning is there:
-		r = b"incorrect \xc8\x0a line\n"
-		l = r.decode('utf-8', 'replace')
-		self.assertEqual(FileContainer.decode_line('TESTFILE', 'utf-8', r), l)
-		self.assertLogged('Error decoding line')
-

 class LogFileFilterPoll(unittest.TestCase):

@@ -1193,15 +1179,13 @@ def get_monitor_failures_testcase(Filter_):

 			# move aside, but leaving the handle still open...
 			os.rename(self.name, self.name + '.bak')
-			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, skip=14, n=1,
-				lines=["Aug 14 11:59:59 [logrotate] rotation 1"]).close()
+			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, skip=14, n=1).close()
 			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 3)

 			# now remove the moved file
 			_killfile(None, self.name + '.bak')
-			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, skip=12, n=3,
-				lines=["Aug 14 11:59:59 [logrotate] rotation 2"]).close()
+			_copy_lines_between_files(GetFailures.FILENAME_01, self.name, skip=12, n=3).close()
 			self.assert_correct_last_attempt(GetFailures.FAILURES_01)
 			self.assertEqual(self.filter.failManager.getFailTotal(), 6)

@@ -1255,7 +1239,7 @@ def get_monitor_failures_testcase(Filter_):
 			os.rename(tmpsub1, tmpsub2 + 'a')
 			os.mkdir(tmpsub1)
 			self.file = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
-												  skip=12, n=1, mode='w', lines=["Aug 14 11:59:59 [logrotate] rotation 1"])
+												  skip=12, n=1, mode='w')
 			self.file.close()
 			self._wait4failures(2)

@@ -1266,7 +1250,7 @@ def get_monitor_failures_testcase(Filter_):
 			os.mkdir(tmpsub1)
 			self.waitForTicks(2)
 			self.file = _copy_lines_between_files(GetFailures.FILENAME_01, self.name,
-												  skip=12, n=1, mode='w', lines=["Aug 14 11:59:59 [logrotate] rotation 2"])
+												  skip=12, n=1, mode='w')
 			self.file.close()
 			self._wait4failures(3)

@@ -1716,49 +1700,16 @@ class GetFailures(LogCaptureTestCase):
 	def testCRLFFailures01(self):
 		# We first adjust logfile/failures to end with CR+LF
 		fname = tempfile.mktemp(prefix='tmp_fail2ban', suffix='crlf')
-		try:
-			# poor man unix2dos:
-			fin, fout = open(GetFailures.FILENAME_01, 'rb'), open(fname, 'wb')
-			for l in fin.read().splitlines():
-				fout.write(l + b'\r\n')
-			fin.close()
-			fout.close()
+		# poor man unix2dos:
+		fin, fout = open(GetFailures.FILENAME_01, 'rb'), open(fname, 'wb')
+		for l in fin.read().splitlines():
+			fout.write(l + b'\r\n')
+		fin.close()
+		fout.close()

-			# now see if we should be getting the "same" failures
-			self.testGetFailures01(filename=fname)
-		finally:
-			_killfile(fout, fname)
-
-	def testNLCharAsPartOfUniChar(self):
-		fname = tempfile.mktemp(prefix='tmp_fail2ban', suffix='uni')
-		# test two multi-byte encodings (both contains `\x0A` in either \x02\x0A or \x0A\x02):
-		for enc in ('utf-16be', 'utf-16le'):
-			self.pruneLog("[test-phase encoding=%s]" % enc)
-			try:
-				fout = open(fname, 'wb')
-				tm = int(time.time())
-				# test on unicode string containing \x0A as part of uni-char,
-				# it must produce exactly 2 lines (both are failures):
-				for l in (
-					u'%s \u20AC Failed auth: invalid user Test\u020A from 192.0.2.1\n' % tm,
-					u'%s \u20AC Failed auth: invalid user TestI from 192.0.2.2\n' % tm
-				):
-					fout.write(l.encode(enc))
-				fout.close()
-
-				self.filter.setLogEncoding(enc)
-				self.filter.addLogPath(fname, autoSeek=0)
-				self.filter.setDatePattern((r'^EPOCH',))
-				self.filter.addFailRegex(r"Failed .* from <HOST>")
-				self.filter.getFailures(fname)
-				self.assertLogged(
-					"[DummyJail] Found 192.0.2.1",
-					"[DummyJail] Found 192.0.2.2", all=True, wait=True)
-			finally:
-				_killfile(fout, fname)
-				self.filter.delLogPath(fname)
-		# must find 4 failures and generate 2 tickets (2 IPs with each 2 failures):
-		self.assertEqual(self.filter.failManager.getFailCount(), (2, 4))
+		# now see if we should be getting the "same" failures
+		self.testGetFailures01(filename=fname)
+		_killfile(fout, fname)

 	def testGetFailures02(self):
 		output = ('141.3.81.106', 4, 1124013539.0,
@@ -2322,7 +2273,6 @@ class DNSUtilsNetworkTests(unittest.TestCase):
 		ip1 = IPAddr('2606:2800:220:1:248:1893:25c8:1946'); ip2 = IPAddr('2606:2800:220:1:248:1893:25c8:1946'); self.assertEqual(id(ip1), id(ip2))

 	def testFQDN(self):
-		unittest.F2B.SkipIfNoNetwork()
 		sname = DNSUtils.getHostname(fqdn=False)
 		lname = DNSUtils.getHostname(fqdn=True)
 		# FQDN is not localhost if short hostname is not localhost too (or vice versa):
@@ -1,627 +0,0 @@
-# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
-# vi: set ft=python sts=4 ts=4 sw=4 noet :
-
-# This file is part of Fail2Ban.
-#
-# Fail2Ban is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# Fail2Ban is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with Fail2Ban; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-
-# Author: Serg G. Brester (sebres)
-# 
-
-__author__ = "Serg G. Brester (sebres)"
-__copyright__ = "Copyright (c) 2014 Serg G. Brester"
-__license__ = "GPL"
-
-import os
-import sys
-import unittest
-import tempfile
-import time
-
-from ..server.mytime import MyTime
-from ..server.ticket import FailTicket, BanTicket
-from ..server.failmanager import FailManager
-from ..server.observer import Observers, ObserverThread
-from ..server.utils import Utils
-from .utils import LogCaptureTestCase
-from .dummyjail import DummyJail
-
-from .databasetestcase import getFail2BanDb, Fail2BanDb
-
-
-class BanTimeIncr(LogCaptureTestCase):
-
-	def setUp(self):
-		"""Call before every test case."""
-		super(BanTimeIncr, self).setUp()
-		self.__jail = DummyJail()
-		self.__jail.calcBanTime = self.calcBanTime
-		self.Observer = ObserverThread()
-
-	def tearDown(self):
-		super(BanTimeIncr, self).tearDown()
-
-	def calcBanTime(self, banTime, banCount):
-		return self.Observer.calcBanTime(self.__jail, banTime, banCount)
-
-	def testDefault(self, multipliers = None):
-		a = self.__jail;
-		a.setBanTimeExtra('increment', 'true')
-		self.assertEqual(a.getBanTimeExtra('increment'), True)
-		a.setBanTimeExtra('maxtime', '1d')
-		self.assertEqual(a.getBanTimeExtra('maxtime'), 24*60*60)
-		a.setBanTimeExtra('rndtime', None)
-		a.setBanTimeExtra('factor', None)
-		# tests formulat or multipliers:
-		a.setBanTimeExtra('multipliers', multipliers)
-		# test algorithm and max time 24 hours :
-		self.assertEqual(
-			[a.calcBanTime(600, i) for i in xrange(1, 11)],
-			[1200, 2400, 4800, 9600, 19200, 38400, 76800, 86400, 86400, 86400]
-		)
-		# with extra large max time (30 days):
-		a.setBanTimeExtra('maxtime', '30d')
-		# using formula the ban time grows always, but using multipliers the growing will stops with last one:
-		arr = [1200, 2400, 4800, 9600, 19200, 38400, 76800, 153600, 307200, 614400]
-		if multipliers is not None:
-			multcnt = len(multipliers.split(' '))
-			if multcnt < 11:
-				arr = arr[0:multcnt-1] + ([arr[multcnt-2]] * (11-multcnt))
-		self.assertEqual(
-			[a.calcBanTime(600, i) for i in xrange(1, 11)],
-			arr
-		)
-		a.setBanTimeExtra('maxtime', '1d')
-		# change factor :
-		a.setBanTimeExtra('factor', '2');
-		self.assertEqual(
-			[a.calcBanTime(600, i) for i in xrange(1, 11)],
-			[2400, 4800, 9600, 19200, 38400, 76800, 86400, 86400, 86400, 86400]
-		)
-		# factor is float :
-		a.setBanTimeExtra('factor', '1.33');
-		self.assertEqual(
-			[int(a.calcBanTime(600, i)) for i in xrange(1, 11)],
-			[1596, 3192, 6384, 12768, 25536, 51072, 86400, 86400, 86400, 86400]
-		)
-		a.setBanTimeExtra('factor', None);
-		# change max time :
-		a.setBanTimeExtra('maxtime', '12h')
-		self.assertEqual(
-			[a.calcBanTime(600, i) for i in xrange(1, 11)],
-			[1200, 2400, 4800, 9600, 19200, 38400, 43200, 43200, 43200, 43200]
-		)
-		a.setBanTimeExtra('maxtime', '24h')
-		## test randomization - not possibe all 10 times we have random = 0:
-		a.setBanTimeExtra('rndtime', '5m')
-		self.assertTrue(
-			False in [1200 in [a.calcBanTime(600, 1) for i in xrange(10)] for c in xrange(10)]
-		)
-		a.setBanTimeExtra('rndtime', None)
-		self.assertFalse(
-			False in [1200 in [a.calcBanTime(600, 1) for i in xrange(10)] for c in xrange(10)]
-		)
-		# restore default:
-		a.setBanTimeExtra('multipliers', None)
-		a.setBanTimeExtra('factor', None);
-		a.setBanTimeExtra('maxtime', '24h')
-		a.setBanTimeExtra('rndtime', None)
-
-	def testMultipliers(self):
-		# this multipliers has the same values as default formula, we test stop growing after count 9:
-		self.testDefault('1 2 4 8 16 32 64 128 256')
-		# this multipliers has exactly the same values as default formula, test endless growing (stops by count 31 only):
-		self.testDefault(' '.join([str(1<<i) for i in xrange(31)]))
-
-	def testFormula(self):
-		a = self.__jail;
-		a.setBanTimeExtra('maxtime', '24h')
-		a.setBanTimeExtra('rndtime', None)
-		## use another formula:
-		a.setBanTimeExtra('formula', 'ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)')
-		a.setBanTimeExtra('factor', '2.0 / 2.885385')
-		a.setBanTimeExtra('multipliers', None)
-		# test algorithm and max time 24 hours :
-		self.assertEqual(
-			[int(a.calcBanTime(600, i)) for i in xrange(1, 11)],
-			[1200, 2400, 4800, 9600, 19200, 38400, 76800, 86400, 86400, 86400]
-		)
-		# with extra large max time (30 days):
-		a.setBanTimeExtra('maxtime', '30d')
-		self.assertEqual(
-			[int(a.calcBanTime(600, i)) for i in xrange(1, 11)],
-			[1200, 2400, 4800, 9600, 19200, 38400, 76800, 153601, 307203, 614407]
-		)
-		a.setBanTimeExtra('maxtime', '24h')
-		# change factor :
-		a.setBanTimeExtra('factor', '1');
-		self.assertEqual(
-			[int(a.calcBanTime(600, i)) for i in xrange(1, 11)],
-			[1630, 4433, 12051, 32758, 86400, 86400, 86400, 86400, 86400, 86400]
-		)
-		a.setBanTimeExtra('factor', '2.0 / 2.885385')
-		# change max time :
-		a.setBanTimeExtra('maxtime', '12h')
-		self.assertEqual(
-			[int(a.calcBanTime(600, i)) for i in xrange(1, 11)],
-			[1200, 2400, 4800, 9600, 19200, 38400, 43200, 43200, 43200, 43200]
-		)
-		a.setBanTimeExtra('maxtime', '24h')
-		## test randomization - not possibe all 10 times we have random = 0:
-		a.setBanTimeExtra('rndtime', '5m')
-		self.assertTrue(
-			False in [1200 in [int(a.calcBanTime(600, 1)) for i in xrange(10)] for c in xrange(10)]
-		)
-		a.setBanTimeExtra('rndtime', None)
-		self.assertFalse(
-			False in [1200 in [int(a.calcBanTime(600, 1)) for i in xrange(10)] for c in xrange(10)]
-		)
-		# restore default:
-		a.setBanTimeExtra('factor', None);
-		a.setBanTimeExtra('multipliers', None)
-		a.setBanTimeExtra('factor', None);
-		a.setBanTimeExtra('maxtime', '24h')
-		a.setBanTimeExtra('rndtime', None)
-
-
-class BanTimeIncrDB(LogCaptureTestCase):
-
-	def setUp(self):
-		"""Call before every test case."""
-		super(BanTimeIncrDB, self).setUp()
-		if Fail2BanDb is None and sys.version_info >= (2,7): # pragma: no cover
-			raise unittest.SkipTest(
-				"Unable to import fail2ban database module as sqlite is not "
-				"available.")
-		elif Fail2BanDb is None:
-			return
-		_, self.dbFilename = tempfile.mkstemp(".db", "fail2ban_")
-		self.db = getFail2BanDb(self.dbFilename)
-		self.jail = DummyJail()
-		self.jail.database = self.db
-		self.Observer = ObserverThread()
-		Observers.Main = self.Observer
-
-	def tearDown(self):
-		"""Call after every test case."""
-		if Fail2BanDb is None: # pragma: no cover
-			return
-		# Cleanup
-		self.Observer.stop()
-		Observers.Main = None
-		os.remove(self.dbFilename)
-		super(BanTimeIncrDB, self).tearDown()
-
-	def incrBanTime(self, ticket, banTime=None):
-		jail = self.jail;
-		if banTime is None:
-			banTime = ticket.getBanTime(jail.actions.getBanTime())
-		ticket.setBanTime(None)
-		incrTime = self.Observer.incrBanTime(jail, banTime, ticket)
-		#print("!!!!!!!!! banTime: %s, %s, incr: %s " % (banTime, ticket.getBanCount(), incrTime))
-		return incrTime
-
-
-	def testBanTimeIncr(self):
-		if Fail2BanDb is None: # pragma: no cover
-			return
-		jail = self.jail
-		self.db.addJail(jail)
-		# we tests with initial ban time = 10 seconds:
-		jail.actions.setBanTime(10)
-		jail.setBanTimeExtra('increment', 'true')
-		jail.setBanTimeExtra('multipliers', '1 2 4 8 16 32 64 128 256 512 1024 2048')
-		ip = "192.0.2.1"
-		# used as start and fromtime (like now but time independence, cause test case can run slow):
-		stime = int(MyTime.time())
-		ticket = FailTicket(ip, stime, [])
-		# test ticket not yet found
-		self.assertEqual(
-			[self.incrBanTime(ticket, 10) for i in xrange(3)], 
-			[10, 10, 10]
-		)
-		# add a ticket banned
-		ticket.incrBanCount()
-		self.db.addBan(jail, ticket)
-		# get a ticket already banned in this jail:
-		self.assertEqual(
-			[(banCount, timeOfBan, lastBanTime) for banCount, timeOfBan, lastBanTime in self.db.getBan(ip, jail, None, False)],
-			[(1, stime, 10)]
-		)
-		# incr time and ban a ticket again :
-		ticket.setTime(stime + 15)
-		self.assertEqual(self.incrBanTime(ticket, 10), 20)
-		self.db.addBan(jail, ticket)
-		# get a ticket already banned in this jail:
-		self.assertEqual(
-			[(banCount, timeOfBan, lastBanTime) for banCount, timeOfBan, lastBanTime in self.db.getBan(ip, jail, None, False)],
-			[(2, stime + 15, 20)]
-		)
-		# get a ticket already banned in all jails:
-		self.assertEqual(
-			[(banCount, timeOfBan, lastBanTime) for banCount, timeOfBan, lastBanTime in self.db.getBan(ip, '', None, True)],
-			[(2, stime + 15, 20)]
-		)
-		# check other optional parameters of getBan:
-		self.assertEqual(
-			[(banCount, timeOfBan, lastBanTime) for banCount, timeOfBan, lastBanTime in self.db.getBan(ip, forbantime=stime, fromtime=stime)],
-			[(2, stime + 15, 20)]
-		)
-		# search currently banned and 1 day later (nothing should be found):
-		self.assertEqual(
-			self.db.getCurrentBans(forbantime=-24*60*60, fromtime=stime, correctBanTime=False),
-			[]
-		)
-		# search currently banned one ticket for ip:
-		restored_tickets = self.db.getCurrentBans(ip=ip, correctBanTime=False)
-		self.assertEqual(
-			str(restored_tickets), 
-			('FailTicket: ip=%s time=%s bantime=20 bancount=2 #attempts=0 matches=[]' % (ip, stime + 15))
-		)
-		# search currently banned anywhere:
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(
-			str(restored_tickets),
-			('[FailTicket: ip=%s time=%s bantime=20 bancount=2 #attempts=0 matches=[]]' % (ip, stime + 15))
-		)
-		# search currently banned:
-		restored_tickets = self.db.getCurrentBans(jail=jail, fromtime=stime, correctBanTime=False)
-		self.assertEqual(
-			str(restored_tickets), 
-			('[FailTicket: ip=%s time=%s bantime=20 bancount=2 #attempts=0 matches=[]]' % (ip, stime + 15))
-		)
-		# increase ban multiple times:
-		lastBanTime = 20
-		for i in xrange(10):
-			ticket.setTime(stime + lastBanTime + 5)
-			banTime = self.incrBanTime(ticket, 10)
-			self.assertEqual(banTime, lastBanTime * 2)
-			self.db.addBan(jail, ticket)
-			lastBanTime = banTime
-		# increase again, but the last multiplier reached (time not increased):
-		ticket.setTime(stime + lastBanTime + 5)
-		banTime = self.incrBanTime(ticket, 10)
-		self.assertNotEqual(banTime, lastBanTime * 2)
-		self.assertEqual(banTime, lastBanTime)
-		self.db.addBan(jail, ticket)
-		lastBanTime = banTime
-		# add two tickets from yesterday: one unbanned (bantime already out-dated):
-		ticket2 = FailTicket(ip+'2', stime-24*60*60, [])
-		ticket2.setBanTime(12*60*60)
-		ticket2.incrBanCount()
-		self.db.addBan(jail, ticket2)
-		# and one from yesterday also, but still currently banned :
-		ticket2 = FailTicket(ip+'1', stime-24*60*60, [])
-		ticket2.setBanTime(36*60*60)
-		ticket2.incrBanCount()
-		self.db.addBan(jail, ticket2)
-		# search currently banned:
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 2)
-		self.assertEqual(
-			str(restored_tickets[0]),
-			'FailTicket: ip=%s time=%s bantime=%s bancount=13 #attempts=0 matches=[]' % (ip, stime + lastBanTime + 5, lastBanTime)
-		)
-		self.assertEqual(
-			str(restored_tickets[1]),
-			'FailTicket: ip=%s time=%s bantime=%s bancount=1 #attempts=0 matches=[]' % (ip+'1', stime-24*60*60, 36*60*60)
-		)
-		# search out-dated (give another fromtime now is -18 hours):
-		restored_tickets = self.db.getCurrentBans(fromtime=stime-18*60*60, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 3)
-		self.assertEqual(
-			str(restored_tickets[2]),
-			'FailTicket: ip=%s time=%s bantime=%s bancount=1 #attempts=0 matches=[]' % (ip+'2', stime-24*60*60, 12*60*60)
-		)
-		# should be still banned
-		self.assertFalse(restored_tickets[1].isTimedOut(stime))
-		self.assertFalse(restored_tickets[1].isTimedOut(stime))
-		# the last should be timed out now
-		self.assertTrue(restored_tickets[2].isTimedOut(stime))
-		self.assertFalse(restored_tickets[2].isTimedOut(stime-18*60*60))
-
-		# test permanent, create timed out:
-		ticket=FailTicket(ip+'3', stime-36*60*60, [])
-		self.assertTrue(ticket.isTimedOut(stime, 600))
-		# not timed out - permanent jail:
-		self.assertFalse(ticket.isTimedOut(stime, -1))
-		# not timed out - permanent ticket:
-		ticket.setBanTime(-1)
-		self.assertFalse(ticket.isTimedOut(stime, 600))
-		self.assertFalse(ticket.isTimedOut(stime, -1))
-		# timed out - permanent jail but ticket time (not really used behavior)
-		ticket.setBanTime(600)
-		self.assertTrue(ticket.isTimedOut(stime, -1))
-
-		# get currently banned pis with permanent one:
-		ticket.setBanTime(-1)
-		ticket.incrBanCount()
-		self.db.addBan(jail, ticket)
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 3)
-		self.assertEqual(
-			str(restored_tickets[2]),
-			'FailTicket: ip=%s time=%s bantime=%s bancount=1 #attempts=0 matches=[]' % (ip+'3', stime-36*60*60, -1)
-		)
-		# purge (nothing should be changed):
-		self.db.purge()
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 3)
-		# set short time and purge again:
-		ticket.setBanTime(600)
-		ticket.incrBanCount()
-		self.db.addBan(jail, ticket)
-		self.db.purge()
-		# this old ticket should be removed now:
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 2)
-		self.assertEqual(restored_tickets[0].getIP(), ip)
-
-		# purge remove 1st ip
-		self.db._purgeAge = -48*60*60
-		self.db.purge()
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 1)
-		self.assertEqual(restored_tickets[0].getIP(), ip+'1')
-
-		# this should purge all bans, bips and logs - nothing should be found now
-		self.db._purgeAge = -240*60*60
-		self.db.purge()
-		restored_tickets = self.db.getCurrentBans(fromtime=stime, correctBanTime=False)
-		self.assertEqual(restored_tickets, [])
-
-		# two separate jails :
-		jail1 = DummyJail(backend='polling')
-		jail1.filter.ignoreSelf = False
-		jail1.setBanTimeExtra('increment', 'true')
-		jail1.database = self.db
-		self.db.addJail(jail1)
-		jail2 = DummyJail(name='DummyJail-2', backend='polling')
-		jail2.filter.ignoreSelf = False
-		jail2.database = self.db
-		self.db.addJail(jail2)
-		ticket1 = FailTicket(ip, stime, [])
-		ticket1.setBanTime(6000)
-		ticket1.incrBanCount()
-		self.db.addBan(jail1, ticket1)
-		ticket2 = FailTicket(ip, stime-6000, [])
-		ticket2.setBanTime(12000)
-		ticket2.setBanCount(1)
-		ticket2.incrBanCount()
-		self.db.addBan(jail2, ticket2)
-		restored_tickets = self.db.getCurrentBans(jail=jail1, fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 1)
-		self.assertEqual(
-			str(restored_tickets[0]),
-			'FailTicket: ip=%s time=%s bantime=%s bancount=1 #attempts=0 matches=[]' % (ip, stime, 6000)
-		)
-		restored_tickets = self.db.getCurrentBans(jail=jail2, fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 1)
-		self.assertEqual(
-			str(restored_tickets[0]),
-			'FailTicket: ip=%s time=%s bantime=%s bancount=2 #attempts=0 matches=[]' % (ip, stime-6000, 12000)
-		)
-		# get last ban values for this ip separately for each jail:
-		for row in self.db.getBan(ip, jail1):
-			self.assertEqual(row, (1, stime, 6000))
-			break
-		for row in self.db.getBan(ip, jail2):
-			self.assertEqual(row, (2, stime-6000, 12000))
-			break
-		# get max values for this ip (over all jails):
-		for row in self.db.getBan(ip, overalljails=True):
-			self.assertEqual(row, (3, stime, 18000))
-			break
-		# test restoring bans from database:
-		jail1.restoreCurrentBans(correctBanTime=False)
-		ticket = jail1.getFailTicket()
-		self.assertTrue(ticket.restored)
-		self.assertEqual(str(ticket), 
-			'FailTicket: ip=%s time=%s bantime=%s bancount=1 #attempts=0 matches=[]' % (ip, stime, 6000)
-		)
-		# jail2 does not restore any bans (because all ban tickets should be already expired: stime-6000):
-		jail2.restoreCurrentBans(correctBanTime=False)
-		self.assertEqual(jail2.getFailTicket(), False)
-		# test again, but now normally (with maximum ban-time of restored ticket = allowed 10m = 600):
-		jail1.setBanTimeExtra('maxtime', '10m')
-		jail1.restoreCurrentBans()
-		ticket = jail1.getFailTicket()
-		self.assertTrue(ticket.restored)
-		# ticket restored, but it has new time = 600 (current ban-time of jail, as maximum):
-		self.assertEqual(str(ticket), 
-			'FailTicket: ip=%s time=%s bantime=%s bancount=1 #attempts=0 matches=[]' % (ip, stime, 600)
-		)
-		# jail2 does not restore any bans (because all ban tickets should be already expired: stime-6000):
-		jail2.restoreCurrentBans()
-		self.assertEqual(jail2.getFailTicket(), False)
-
-	def testObserver(self):
-		if Fail2BanDb is None: # pragma: no cover
-			return
-		jail = self.jail
-		self.db.addJail(jail)
-		# we tests with initial ban time = 10 seconds:
-		jail.actions.setBanTime(10)
-		jail.setBanTimeExtra('increment', 'true')
-		# observer / database features:
-		obs = Observers.Main
-		obs.start()
-		obs.db_set(self.db)
-		# wait for start ready
-		obs.add('nop')
-		obs.wait_empty(5)
-		# purge database right now, but using timer, to test it also:
-		self.db._purgeAge = -240*60*60
-		obs.add_named_timer('DB_PURGE', 0.001, 'db_purge')
-		self.assertLogged("Purge database event occurred", wait=True); # wait for purge timer
-		# wait for timer ready
-		obs.wait_idle(0.025)
-		# wait for ready
-		obs.add('nop')
-		obs.wait_empty(5)
-
-		stime = int(MyTime.time())
-		# completelly empty ?
-		tickets = self.db.getBans()
-		self.assertEqual(tickets, [])
-
-		# add failure:
-		ip = "192.0.2.1"
-		ticket = FailTicket(ip, stime-120, [])
-		failManager = FailManager()
-		failManager.setMaxRetry(3)
-		for i in xrange(3):
-			failManager.addFailure(ticket)
-			obs.add('failureFound', failManager, jail, ticket)
-		obs.wait_empty(5)
-		self.assertEqual(ticket.getBanCount(), 0)
-		# check still not ban :
-		self.assertTrue(not jail.getFailTicket())
-		# add manually 4th times banned (added to bips - make ip bad):
-		ticket.setBanCount(4)
-		self.db.addBan(self.jail, ticket)
-		restored_tickets = self.db.getCurrentBans(jail=jail, fromtime=stime-120, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 1)
-		# check again, new ticket, new failmanager:
-		ticket = FailTicket(ip, stime, [])
-		failManager = FailManager()
-		failManager.setMaxRetry(3)
-		# add once only - but bad - should be banned:
-		failManager.addFailure(ticket)
-		obs.add('failureFound', failManager, self.jail, ticket)
-		obs.wait_empty(5)
-		# wait until ticket transfered from failmanager into jail:
-		ticket2 = Utils.wait_for(jail.getFailTicket, 10)
-		# check ticket and failure count:
-		self.assertTrue(ticket2)
-		self.assertEqual(ticket2.getRetry(), failManager.getMaxRetry())
-
-		# wrap FailTicket to BanTicket:
-		failticket2 = ticket2
-		ticket2 = BanTicket.wrap(failticket2)
-		self.assertEqual(ticket2, failticket2)
-		# add this ticket to ban (use observer only without ban manager):
-		obs.add('banFound', ticket2, jail, 10)
-		obs.wait_empty(5)
-		# increased?
-		self.assertEqual(ticket2.getBanTime(), 160)
-		self.assertEqual(ticket2.getBanCount(), 5)
-
-		# check prolonged in database also :
-		restored_tickets = self.db.getCurrentBans(jail=jail, fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 1)
-		self.assertEqual(restored_tickets[0].getBanTime(), 160)
-		self.assertEqual(restored_tickets[0].getBanCount(), 5)
-
-		# now using jail/actions:
-		ticket = FailTicket(ip, stime-60, ['test-expired-ban-time'])
-		jail.putFailTicket(ticket)
-		self.assertFalse(jail.actions.checkBan())
-
-		ticket = FailTicket(ip, MyTime.time(), ['test-actions'])
-		jail.putFailTicket(ticket)
-		self.assertTrue(jail.actions.checkBan())
-
-		obs.wait_empty(5)
-		restored_tickets = self.db.getCurrentBans(jail=jail, fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 1)
-		self.assertEqual(restored_tickets[0].getBanTime(), 320)
-		self.assertEqual(restored_tickets[0].getBanCount(), 6)
-
-		# and permanent:
-		ticket = FailTicket(ip+'1', MyTime.time(), ['test-permanent'])
-		ticket.setBanTime(-1)
-		jail.putFailTicket(ticket)
-		self.assertTrue(jail.actions.checkBan())
-
-		obs.wait_empty(5)
-		ticket = FailTicket(ip+'1', MyTime.time(), ['test-permanent'])
-		ticket.setBanTime(600)
-		jail.putFailTicket(ticket)
-		self.assertFalse(jail.actions.checkBan())
-
-		obs.wait_empty(5)
-		restored_tickets = self.db.getCurrentBans(jail=jail, fromtime=stime, correctBanTime=False)
-		self.assertEqual(len(restored_tickets), 2)
-		self.assertEqual(restored_tickets[1].getBanTime(), -1)
-		self.assertEqual(restored_tickets[1].getBanCount(), 1)
-
-		# stop observer
-		obs.stop()
-
-class ObserverTest(LogCaptureTestCase):
-
-	def setUp(self):
-		"""Call before every test case."""
-		super(ObserverTest, self).setUp()
-
-	def tearDown(self):
-		"""Call after every test case."""
-		super(ObserverTest, self).tearDown()
-
-	def testObserverBanTimeIncr(self):
-		obs = ObserverThread()
-		obs.start()
-		# wait for idle
-		obs.wait_idle(1)
-		# observer will replace test set:
-		o = set(['test'])
-		obs.add('call', o.clear)
-		obs.add('call', o.add, 'test2')
-		# wait for observer ready:
-		obs.wait_empty(1)
-		self.assertFalse(obs.is_full)
-		self.assertEqual(o, set(['test2']))
-		# observer makes pause
-		obs.paused = True
-		# observer will replace test set, but first after pause ends:
-		obs.add('call', o.clear)
-		obs.add('call', o.add, 'test3')
-		obs.wait_empty(10 * Utils.DEFAULT_SLEEP_TIME)
-		self.assertTrue(obs.is_full)
-		self.assertEqual(o, set(['test2']))
-		obs.paused = False
-		# wait running:
-		obs.wait_empty(1)
-		self.assertEqual(o, set(['test3']))
-
-		self.assertTrue(obs.isActive())
-		self.assertTrue(obs.isAlive())
-		obs.stop()
-		obs = None
-
-	class _BadObserver(ObserverThread):
-		def run(self):
-			raise RuntimeError('run bad thread exception')
-
-	def testObserverBadRun(self):
-		obs = ObserverTest._BadObserver()
-		# don't wait for empty by stop
-		obs.wait_empty = lambda v:()
-		# save previous hook, prevent write stderr and check hereafter __excepthook__ was executed
-		prev_exchook = sys.__excepthook__
-		x = []
-		sys.__excepthook__ = lambda *args: x.append(args)
-		try:
-			obs.start()
-			obs.stop()
-			obs.join()
-			self.assertTrue( Utils.wait_for( lambda: len(x) and self._is_logged("Unhandled exception"), 3) )
-		finally:
-			sys.__excepthook__ = prev_exchook
-		self.assertLogged("Unhandled exception")
-		self.assertEqual(len(x), 1)
-		self.assertEqual(x[0][0], RuntimeError)
-		self.assertEqual(str(x[0][1]), 'run bad thread exception')
@@ -23,6 +23,7 @@ __copyright__ = "Copyright (c) 2013 Steven Hiscocks"
 __license__ = "GPL"

 import datetime
+import fileinput
 import inspect
 import json
 import os
@@ -155,15 +156,12 @@ def testSampleRegexsFactory(name, basedir):
 		i = 0
 		while i < len(filenames):
 			filename = filenames[i]; i += 1;
-			logFile = FileContainer(os.path.join(TEST_FILES_DIR, "logs",
-				filename), 'UTF-8', doOpen=True)
-			# avoid errors if no NL char at end of test log-file:
-			logFile.waitForLineEnd = False
+			logFile = fileinput.FileInput(os.path.join(TEST_FILES_DIR, "logs",
+				filename), mode='rb')

 			ignoreBlock = False
-			lnnum = 0
 			for line in logFile:
-				lnnum += 1
+				line = FileContainer.decode_line(logFile.filename(), 'UTF-8', line)
 				jsonREMatch = re.match("^#+ ?(failJSON|(?:file|filter)Options|addFILE):(.+)$", line)
 				if jsonREMatch:
 					try:
@@ -203,8 +201,9 @@ def testSampleRegexsFactory(name, basedir):
 						# failJSON - faildata contains info of the failure to check it.
 					except ValueError as e: # pragma: no cover - we've valid json's
 						raise ValueError("%s: %s:%i" %
-							(e, logFile.getFileName(), lnnum))
+							(e, logFile.filename(), logFile.filelineno()))
 					line = next(logFile)
+					line = FileContainer.decode_line(logFile.filename(), 'UTF-8', line)
 				elif ignoreBlock or line.startswith("#") or not line.strip():
 					continue
 				else: # pragma: no cover - normally unreachable
@@ -299,7 +298,7 @@ def testSampleRegexsFactory(name, basedir):
 						import pprint
 						raise AssertionError("%s: %s on: %s:%i, line:\n  %s\nregex (%s):\n  %s\n"
 							"faildata: %s\nfail: %s" % (
-								fltName, e, logFile.getFileName(), lnnum, 
+								fltName, e, logFile.filename(), logFile.filelineno(), 
 								line, failregex, regexList[failregex] if failregex != -1 else None,
 								'\n'.join(pprint.pformat(faildata).splitlines()),
 								'\n'.join(pprint.pformat(fail).splitlines())))
@@ -41,7 +41,7 @@ from ..server.jailthread import JailThread
 from ..server.ticket import BanTicket
 from ..server.utils import Utils
 from .dummyjail import DummyJail
-from .utils import LogCaptureTestCase, with_alt_time, MyTime
+from .utils import LogCaptureTestCase
 from ..helpers import getLogger, extractOptions, PREFER_ENC
 from .. import version

@@ -394,50 +394,6 @@ class Transmitter(TransmitterBase):
 		self.assertLogged("Ban 192.0.2.2", wait=True)
 		self.assertNotLogged("Ban 192.0.2.1")

-	@with_alt_time
-	def testJailBanList(self):
-		jail = "TestJailBanList"
-		self.server.addJail(jail, FAST_BACKEND)
-		self.server.startJail(jail)
-
-		# Helper to process set banip/set unbanip commands and compare the list of
-		# banned IP addresses with outList.
-		def _getBanListTest(jail, banip=None, unbanip=None, args=(), outList=[]):
-			# Ban IP address
-			if banip is not None:
-				self.assertEqual(
-					self.transm.proceed(["set", jail, "banip", banip]),
-					(0, 1))
-				self.assertLogged("Ban %s" % banip, wait=True) # Give chance to ban
-			# Unban IP address
-			if unbanip is not None:
-				self.assertEqual(
-					self.transm.proceed(["set", jail, "unbanip", unbanip]),
-					(0, 1))
-				self.assertLogged("Unban %s" % unbanip, wait=True) # Give chance to unban
-			# Compare the list of banned IP addresses with outList
-			self.assertSortedEqual(
-				self.transm.proceed(["get", jail, "banip"]+list(args)),
-				(0, outList), nestedOnly=False)
-			MyTime.setTime(MyTime.time() + 1)
-
-		_getBanListTest(jail,
-			outList=[])
-		_getBanListTest(jail, banip="127.0.0.1", args=('--with-time',), 
-			outList=["127.0.0.1 \t2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01"])
-		_getBanListTest(jail, banip="192.168.0.1", args=('--with-time',), 
-			outList=[
-				"127.0.0.1 \t2005-08-14 12:00:01 + 600 = 2005-08-14 12:10:01",
-				"192.168.0.1 \t2005-08-14 12:00:02 + 600 = 2005-08-14 12:10:02"])
-		_getBanListTest(jail, banip="192.168.1.10",
-			outList=["127.0.0.1", "192.168.0.1", "192.168.1.10"])
-		_getBanListTest(jail, unbanip="127.0.0.1",
-			outList=["192.168.0.1", "192.168.1.10"])
-		_getBanListTest(jail, unbanip="192.168.1.10",
-			outList=["192.168.0.1"])
-		_getBanListTest(jail, unbanip="192.168.0.1",
-			outList=[])
-
 	def testJailMaxMatches(self):
 		self.setGetTest("maxmatches", "5", 5, jail=self.jailName)
 		self.setGetTest("maxmatches", "2", 2, jail=self.jailName)
@@ -1050,15 +1006,6 @@ class TransmitterLogging(TransmitterBase):
 		self.assertEqual(self.transm.proceed(["set", "logtarget", "STDERR"]), (0, "STDERR"))
 		self.assertEqual(self.transm.proceed(["flushlogs"]), (0, "flushed"))

-	def testBanTimeIncr(self):
-		self.setGetTest("bantime.increment", "true", True, jail=self.jailName)
-		self.setGetTest("bantime.rndtime", "30min", 30*60, jail=self.jailName)
-		self.setGetTest("bantime.maxtime", "1000 days", 1000*24*60*60, jail=self.jailName)
-		self.setGetTest("bantime.factor", "2", "2", jail=self.jailName)
-		self.setGetTest("bantime.formula", "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)", jail=self.jailName)
-		self.setGetTest("bantime.multipliers", "1 5 30 60 300 720 1440 2880", "1 5 30 60 300 720 1440 2880", jail=self.jailName)
-		self.setGetTest("bantime.overalljails", "true", "true", jail=self.jailName)
-

 class JailTests(unittest.TestCase):

@@ -1226,20 +1173,8 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 				logSys.debug(l)
 		return True

-	def _testActionInfos(self):
-		if not hasattr(self, '__aInfos'):
-			dmyjail = DummyJail()
-			self.__aInfos = {}
-			for t, ip in (('ipv4', '192.0.2.1'), ('ipv6', '2001:DB8::')):
-				ticket = BanTicket(ip)
-				ticket.setBanTime(600)
-				self.__aInfos[t] = _actions.Actions.ActionInfo(ticket, dmyjail)
-		return self.__aInfos
-
 	def _testExecActions(self, server):
 		jails = server._Server__jails
-
-		aInfos = self._testActionInfos()
 		for jail in jails:
 			# print(jail, jails[jail])
 			for a in jails[jail].actions:
@@ -1256,16 +1191,16 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 				action.start()
 				# test ban ip4 :
 				logSys.debug('# === ban-ipv4 ==='); self.pruneLog()
-				action.ban(aInfos['ipv4'])
+				action.ban({'ip': IPAddr('192.0.2.1'), 'family': 'inet4'})
 				# test unban ip4 :
 				logSys.debug('# === unban ipv4 ==='); self.pruneLog()
-				action.unban(aInfos['ipv4'])
+				action.unban({'ip': IPAddr('192.0.2.1'), 'family': 'inet4'})
 				# test ban ip6 :
 				logSys.debug('# === ban ipv6 ==='); self.pruneLog()
-				action.ban(aInfos['ipv6'])
+				action.ban({'ip': IPAddr('2001:DB8::'), 'family': 'inet6'})
 				# test unban ip6 :
 				logSys.debug('# === unban ipv6 ==='); self.pruneLog()
-				action.unban(aInfos['ipv6'])
+				action.unban({'ip': IPAddr('2001:DB8::'), 'family': 'inet6'})
 				# test stop :
 				logSys.debug('# === stop ==='); self.pruneLog()
 				action.stop()
@@ -1461,10 +1396,9 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 				),					
 			}),
 			# dummy --
-			('j-dummy', '''dummy[name=%(__name__)s, init="=='<family>/<ip>'==bt:<bantime>==bc:<bancount>==", target="/tmp/fail2ban.dummy"]''', {
+			('j-dummy', 'dummy[name=%(__name__)s, init="==", target="/tmp/fail2ban.dummy"]', {
 				'ip4': ('family: inet4',), 'ip6': ('family: inet6',),
 				'start': (
-					'''`printf %b "=='/'==bt:600==bc:0==\\n"''', ## empty family (independent in this action, same for both), no ip on start, initial bantime and bancount
 					'`echo "[j-dummy] dummy /tmp/fail2ban.dummy -- started"`',
 				), 
 				'flush': (
@@ -2056,7 +1990,10 @@ class ServerConfigReaderTests(LogCaptureTestCase):

 		jails = server._Server__jails

-		aInfos = self._testActionInfos()
+		tickets = {
+			'ip4': BanTicket('192.0.2.1'),
+			'ip6': BanTicket('2001:DB8::'),
+		}
 		for jail, act, tests in testJailsActions:
 			# print(jail, jails[jail])
 			for a in jails[jail].actions:
@@ -2074,43 +2011,34 @@ class ServerConfigReaderTests(LogCaptureTestCase):
 					self.assertLogged(*tests['start'], all=True)
 				elif tests.get('ip4-start') and tests.get('ip6-start'):
 					self.assertNotLogged(*tests['ip4-start']+tests['ip6-start'], all=True)
+				ainfo = {
+					'ip4': _actions.Actions.ActionInfo(tickets['ip4'], jails[jail]),
+					'ip6': _actions.Actions.ActionInfo(tickets['ip6'], jails[jail]),
+				}
 				# test ban ip4 :
 				self.pruneLog('# === ban-ipv4 ===')
-				action.ban(aInfos['ipv4'])
+				action.ban(ainfo['ip4'])
 				if tests.get('ip4-start'): self.assertLogged(*tests.get('*-start', ())+tests['ip4-start'], all=True)
 				if tests.get('ip6-start'): self.assertNotLogged(*tests['ip6-start'], all=True)
-				self.assertLogged(*tests['ip4-ban'], all=True)
+				self.assertLogged(*tests.get('ip4-check',())+tests['ip4-ban'], all=True)
 				self.assertNotLogged(*tests['ip6'], all=True)
 				# test unban ip4 :
 				self.pruneLog('# === unban ipv4 ===')
-				action.unban(aInfos['ipv4'])
-				self.assertLogged(*tests['ip4-unban'], all=True)
+				action.unban(ainfo['ip4'])
+				self.assertLogged(*tests.get('ip4-check',())+tests['ip4-unban'], all=True)
 				self.assertNotLogged(*tests['ip6'], all=True)
 				# test ban ip6 :
 				self.pruneLog('# === ban ipv6 ===')
-				action.ban(aInfos['ipv6'])
+				action.ban(ainfo['ip6'])
 				if tests.get('ip6-start'): self.assertLogged(*tests.get('*-start', ())+tests['ip6-start'], all=True)
 				if tests.get('ip4-start'): self.assertNotLogged(*tests['ip4-start'], all=True)
-				self.assertLogged(*tests['ip6-ban'], all=True)
+				self.assertLogged(*tests.get('ip6-check',())+tests['ip6-ban'], all=True)
 				self.assertNotLogged(*tests['ip4'], all=True)
 				# test unban ip6 :
 				self.pruneLog('# === unban ipv6 ===')
-				action.unban(aInfos['ipv6'])
-				self.assertLogged(*tests['ip6-unban'], all=True)
+				action.unban(ainfo['ip6'])
+				self.assertLogged(*tests.get('ip6-check',())+tests['ip6-unban'], all=True)
 				self.assertNotLogged(*tests['ip4'], all=True)
-				# test invariant check (normally on demand in error case only):
-				if tests.get('ip4-check'):
-					self.pruneLog('# === check ipv4 ===')
-					action._invariantCheck(aInfos['ipv4']['family'])
-					self.assertLogged(*tests['ip4-check'], all=True)
-					if tests.get('ip6-check') and tests['ip6-check'] != tests['ip4-check']:
-						self.assertNotLogged(*tests['ip6-check'], all=True)
-				if tests.get('ip6-check'):
-					self.pruneLog('# === check ipv6 ===')
-					action._invariantCheck(aInfos['ipv6']['family'])
-					self.assertLogged(*tests['ip6-check'], all=True)
-					if tests.get('ip4-check') and tests['ip4-check'] != tests['ip6-check']:
-						self.assertNotLogged(*tests['ip4-check'], all=True)
 				# test flush for actions should supported this:
 				if tests.get('flush'):
 					self.pruneLog('# === flush ===')
@@ -54,7 +54,6 @@ class Socket(LogCaptureTestCase):

 	def setUp(self):
 		"""Call before every test case."""
-		LogCaptureTestCase.setUp(self)
 		super(Socket, self).setUp()
 		self.server = AsyncServer(self)
 		sock_fd, sock_name = tempfile.mkstemp('fail2ban.sock', 'f2b-socket')
@@ -388,7 +388,6 @@ def gatherTests(regexps=None, opts=None):
 	from . import sockettestcase
 	from . import misctestcase
 	from . import databasetestcase
-	from . import observertestcase
 	from . import samplestestcase
 	from . import fail2banclienttestcase
 	from . import fail2banregextestcase
@@ -419,6 +418,7 @@ def gatherTests(regexps=None, opts=None):
 		tests = FilteredTestSuite()

 	# Server
+	#tests.addTest(unittest.makeSuite(servertestcase.StartStop))
 	tests.addTest(unittest.makeSuite(servertestcase.Transmitter))
 	tests.addTest(unittest.makeSuite(servertestcase.JailTests))
 	tests.addTest(unittest.makeSuite(servertestcase.RegexTests))
@@ -458,10 +458,6 @@ def gatherTests(regexps=None, opts=None):
 	tests.addTest(unittest.makeSuite(misctestcase.MyTimeTest))
 	# Database
 	tests.addTest(unittest.makeSuite(databasetestcase.DatabaseTest))
-	# Observer
-	tests.addTest(unittest.makeSuite(observertestcase.ObserverTest))
-	tests.addTest(unittest.makeSuite(observertestcase.BanTimeIncr))
-	tests.addTest(unittest.makeSuite(observertestcase.BanTimeIncrDB))

 	# Filter
 	tests.addTest(unittest.makeSuite(filtertestcase.IgnoreIP))
@@ -768,11 +764,10 @@ class LogCaptureTestCase(unittest.TestCase):
 		# Let's log everything into a string
 		self._log = LogCaptureTestCase._MemHandler(unittest.F2B.log_lazy)
 		logSys.handlers = [self._log]
-		# lowest log level to capture messages (expected in tests) is Lev.9
-		if self._old_level <= logging.DEBUG: # pragma: no cover
+		if self._old_level <= logging.DEBUG:
 			logSys.handlers += self._old_handlers
-		if self._old_level > logging.DEBUG-1:
-			logSys.setLevel(logging.DEBUG-1)
+		else: # lowest log level to capture messages
+			logSys.setLevel(logging.DEBUG)
 		super(LogCaptureTestCase, self).setUp()

 	def tearDown(self):
@@ -24,7 +24,7 @@ __author__ = "Cyril Jaquier, Yaroslav Halchenko, Steven Hiscocks, Daniel Black"
 __copyright__ = "Copyright (c) 2004 Cyril Jaquier, 2005-2016 Yaroslav Halchenko, 2013-2014 Steven Hiscocks, Daniel Black"
 __license__ = "GPL-v2+"

-version = "1.0.1.dev1"
+version = "0.10.6"

 def normVersion():
  """ Returns fail2ban version in normalized machine-readable format"""
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.47.4.
-.TH FAIL2BAN-CLIENT "1" "February 2020" "fail2ban-client v1.0.1.dev1" "User Commands"
+.TH FAIL2BAN-CLIENT "1" "November 2020" "fail2ban-client v0.10.6" "User Commands"
 .SH NAME
 fail2ban-client \- configure and control the server
 .SH SYNOPSIS
 .B fail2ban-client
 [\fI\,OPTIONS\/\fR] \fI\,<COMMAND>\/\fR
 .SH DESCRIPTION
-Fail2Ban v1.0.1.dev1 reads log file that contains password failure report
+Fail2Ban v0.10.6 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -415,21 +415,12 @@ gets the time a host is banned for
 <JAIL>
 .TP
 \fBget <JAIL> datepattern\fR
-gets the pattern used to match
+gets the patern used to match
 date/times for <JAIL>
 .TP
 \fBget <JAIL> usedns\fR
 gets the usedns setting for <JAIL>
 .TP
-\fBget <JAIL> banip [<SEP>|\-\-with\-time]\fR
-gets the list of of banned IP
-addresses for <JAIL>. Optionally
-the separator character ('<SEP>',
-default is space) or the option
-\&'\-\-with\-time' (printing the times
-of ban) may be specified. The IPs
-are ordered by end of ban.
-.TP
 \fBget <JAIL> maxretry\fR
 gets the number of failures
 allowed for <JAIL>
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.47.4.
-.TH FAIL2BAN-PYTHON "1" "January 2020" "fail2ban-python 1.0.1.1" "User Commands"
+.TH FAIL2BAN-PYTHON "1" "November 2020" "fail2ban-python 0.10.6" "User Commands"
 .SH NAME
 fail2ban-python \- a helper for Fail2Ban to assure that the same Python is used
 .SH DESCRIPTION
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.47.4.
-.TH FAIL2BAN-REGEX "1" "January 2020" "fail2ban-regex 1.0.1.dev1" "User Commands"
+.TH FAIL2BAN-REGEX "1" "November 2020" "fail2ban-regex 0.10.6" "User Commands"
 .SH NAME
 fail2ban-regex \- test Fail2ban "failregex" option
 .SH SYNOPSIS
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.47.4.
-.TH FAIL2BAN-SERVER "1" "February 2020" "fail2ban-server v1.0.1.dev1" "User Commands"
+.TH FAIL2BAN-SERVER "1" "November 2020" "fail2ban-server v0.10.6" "User Commands"
 .SH NAME
 fail2ban-server \- start the server
 .SH SYNOPSIS
 .B fail2ban-server
 [\fI\,OPTIONS\/\fR]
 .SH DESCRIPTION
-Fail2Ban v1.0.1.dev1 reads log file that contains password failure report
+Fail2Ban v0.10.6 reads log file that contains password failure report
 and bans the corresponding IP addresses using firewall rules.
 .SH OPTIONS
 .TP
@@ -1,5 +1,5 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.47.4.
-.TH FAIL2BAN-TESTCASES "1" "January 2020" "fail2ban-testcases 1.0.1.dev1" "User Commands"
+.TH FAIL2BAN-TESTCASES "1" "November 2020" "fail2ban-testcases 0.10.6" "User Commands"
 .SH NAME
 fail2ban-testcases \- run Fail2Ban unit-tests
 .SH SYNOPSIS
@@ -271,7 +271,7 @@ effective ban duration (in seconds or time abbreviation format).
 time interval (in seconds or time abbreviation format) before the current time where failures will count towards a ban.
 .TP
 .B maxretry
-number of failures that have to occur in the last \fBfindtime\fR seconds to ban the IP.
+number of failures that have to occur in the last \fBfindtime\fR seconds to ban then IP.
 .TP
 .B backend
 backend to be used to detect changes in the logpath.
@@ -487,7 +487,7 @@ is the regex (\fBreg\fRular \fBex\fRpression) that will match failed attempts. T
 .IP
 \fI<CIDR>\fR - helper regex to match CIDR (simple integer form of net-mask).
 .IP
-\fI<SUBNET>\fR - regex to match sub-net addresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional).
+\fI<SUBNET>\fR - regex to match sub-net adresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional).
 .IP
 \fI<F-ID>...</F-ID>\fR - free regex capturing group targeting identifier used for ban (instead of IP address or hostname).
 .IP
@@ -540,7 +540,7 @@ There are several prefixes and words with special meaning that could be specifie
 .IP
 \fI{UNB}\fR - prefix to disable automatic word boundaries in regex.
 .IP
-\fI{NONE}\fR - value would allow one to find failures totally without date-time in log message. Filter will use now as a timestamp (or last known timestamp from previous line with timestamp).
+\fI{NONE}\fR - value would allow to find failures totally without date-time in log message. Filter will use now as a timestamp (or last known timestamp from previous line with timestamp).
 .RE
 .TP
 \fBjournalmatch\fR