fail2ban not banning, time is off, how do I sync them?

Question

In searching for why fail2ban is not banning patterns, I found that when I run /etc/init.d/fail2ban status it reports over an hour behind my 'date' command.

'date' says its: Tue Mar 18 20:45:02 MST 2014

Output of status returns: Mar 05 19:16:30 fed8 systemd[1]: Starting LSB: Start/Stop fail2ban...

I know my 'date' is correct, why is fail2ban not in sync and how do I fix that? Is there a config option to force it to get the unix command 'date' instead?

Im using fail2ban 8.12 Thanks

EDIT: Added patch from bug report, didnt change things. I should have included the full output. The date is way off as well, almost 2 weeks old? Why is that? It seems the status isnt reporting whats going on the last time I tried to start it? When I do a ps I see that the fail2ban-server is indeed 'running':

root     26430  0.4  0.1 1268652 14820 ?       Sl   21:58   0:01 /usr/bin/python    /usr/bin/fail2ban-server -b -s /var/run/fail2ban/fail2ban.sock -p /var/run/fail2ban/fail2ban.pid -x


/etc/init.d/fail2ban status
fail2ban.service - LSB: Start/Stop fail2ban
Loaded: loaded (/etc/rc.d/init.d/fail2ban)
Active: failed (Result: exit-code) since Wed 2014-03-05 19:26:00 MST; 1 weeks 6 days ago
Main PID: 1145 (code=exited, status=0/SUCCESS)
CGroup: name=systemd:/system/fail2ban.service

Mar 05 19:16:30 fed8 systemd[1]: Starting LSB: Start/Stop fail2ban...
Mar 05 19:16:33 fed8 fail2ban[945]: Starting fail2ban: ERROR  No section: 'Definition'
Mar 05 19:16:33 fed8 fail2ban[945]: ERROR  No section: 'Definition'
Mar 05 19:16:38 fed8 fail2ban[945]: [  OK  ]
Mar 05 19:16:38 fed8 systemd[1]: Started LSB: Start/Stop fail2ban.
Mar 05 19:26:00 fed8 fail2ban[3481]: Stopping fail2ban: ERROR  Unable to contact server.    Is it running?
Mar 05 19:26:00 fed8 fail2ban[3481]: [FAILED]
Mar 05 19:26:00 fed8 systemd[1]: fail2ban.service: control process exited, code=exited status=255
Mar 05 19:26:00 fed8 systemd[1]: Unit fail2ban.service entered failed state.

e

EDIT2: I found that I needed to use 'system fail2ban start' rather than using the command line. This fixed the status reporting. The fail2ban log file correctly shows the startup time in sync with the 'date' command now, however it's still not banning. I ran fail2ban-regex on the last pattern I saw in my file and it should have picked it up but did not.

EDIT3: I still cant figure out why it wont ban patterns. fail2ban-regex is catching my patterns properly when I run it manually. The only other thing I found in another post is that someone suggested running 'system iptables status' which produced:

163 ROOT fed8 /etc/fail2ban service iptables status
Redirecting to /bin/systemctl status  iptables.service
iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled)
   Active: inactive (dead)
       start condition failed at Sun 2014-03-23 18:23:40 MST; 3s ago

Mar 23 18:23:40 fed8 systemd[1]: Started IPv4 firewall with iptables.

Now my question is, if this is the reason its not running, WHY? isnt iptables just called directly by fail2ban to ban/unban stuff? Ive never run iptables as a service. I run it directly out of /etc/rc.local. If this isnt the issue, can anyone tell me why this thing fails to ban?? Im beginning to wonder if its not easier to write my own banning program so at least I know I can count on it rather than having to check that this thing is still catching patterns from day to day! So frustrating. I got other work to do than babysit fail2ban. Im quickly losing faith in it.

Answer 1

It looks alot like a configuration issue. The specific error message is:

Mar 05 19:16:33 fed8 fail2ban[945]: Starting fail2ban: ERROR No section: 'Definition'

So, the next step is to find out what file is being used as a configuration file by fail2ban, which appears to typically be in /etc/fail2ban, possibly starting in jail.conf (it looks as though it might have a multi-file configuration).

Having found the configuration, you would work out why, in the course of parsing the configuration, the program fails to find a section named "Definition" that it expects and apparently requires.

The date you see in the /etc/init.d/fail2ban status command output is the last time the program functioned correctly, not the current date from the perspective of the program.