From fe9e85c71d73d7ec57048113768f2a02fa110ba6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Allan=20Nordh=C3=B8y?= <epost@anotheragency.no>
Date: Fri, 10 Nov 2017 23:56:10 +0100
Subject: [PATCH 01/13] "Fail2Ban", other language improvements

---
 README.md | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/README.md b/README.md
index 1138a3ac..71997c98 100644
--- a/README.md
+++ b/README.md
@@ -6,45 +6,45 @@
 
 ## Fail2Ban: ban hosts that cause multiple authentication errors
 
-Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses having
+Fail2Ban scans log files like `/var/log/auth.log` and bans IP addresses conducting
 too many failed login attempts. It does this by updating system firewall rules
 to reject new connections from those IP addresses, for a configurable amount
 of time. Fail2Ban comes out-of-the-box ready to read many standard log files,
-such as those for sshd and Apache, and is easy to configure to read any log
-file you choose, for any error you choose.
+such as those for sshd and Apache, and is easily configured to read any log
+file of your choosing, for any error you wish.
 
-Though Fail2Ban is able to reduce the rate of incorrect authentications
-attempts, it cannot eliminate the risk that weak authentication presents.
-Configure services to use only two factor or public/private authentication
+Though Fail2Ban is able to reduce the rate of incorrect authentication
+attempts, it cannot eliminate the risk presented by weak authentication.
+Set up services to use only two factor, or public/private authentication
 mechanisms if you really want to protect services.
 
-This README is a quick introduction to Fail2ban. More documentation, FAQ, HOWTOs
-are available in fail2ban(1) manpage and on the website http://www.fail2ban.org
+This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
+available in the fail2ban(1) manpage and on the website https://www.fail2ban.org
 
 Installation:
 -------------
 
-**It is possible that Fail2ban is already packaged for your distribution.  In
-this case, you should use it instead.**
+**It is possible that Fail2Ban is already packaged for your distribution.  In
+this case, you should use that instead.**
 
 Required:
-- [Python2 >= 2.6 or Python >= 3.2](http://www.python.org) or [PyPy](http://pypy.org)
+- [Python2 >= 2.6 or Python >= 3.2](https://www.python.org) or [PyPy](https://pypy.org)
 
 Optional:
 - [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
-  - Linux >= 2.6.13
-- [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
-- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd)
+- Linux >= 2.6.13
+- [gamin >= 0.0.21](https://www.gnome.org/~veillard/gamin)
+- [systemd >= 204](https://www.freedesktop.org/wiki/Software/systemd)
 - [dnspython](http://www.dnspython.org/)
 
-To install, just do:
+To install:
 
     tar xvfj fail2ban-0.9.7.tar.bz2
     cd fail2ban-0.9.7
     python setup.py install
 
 This will install Fail2Ban into the python library directory. The executable
-scripts are placed into `/usr/bin`, and configuration under `/etc/fail2ban`.
+scripts are placed into `/usr/bin`, and configuration in `/etc/fail2ban`.
 
 Fail2Ban should be correctly installed now. Just type:
 
@@ -86,7 +86,7 @@ Contact:
 See [CONTRIBUTING.md](https://github.com/fail2ban/fail2ban/blob/master/CONTRIBUTING.md)
 
 ### You just appreciate this program:
-send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>))
+Send kudos to the original author ([Cyril Jaquier](mailto: Cyril Jaquier <cyril.jaquier@fail2ban.org>))
 or *better* to the [mailing list](https://lists.sourceforge.net/lists/listinfo/fail2ban-users)
 since Fail2Ban is "community-driven" for years now.
 

From 855f5d0ced70247ec80823ae4c8507adbd14554b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Allan=20Nordh=C3=B8y?= <epost@anotheragency.no>
Date: Sat, 11 Nov 2017 14:03:15 +0100
Subject: [PATCH 02/13] to be found

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 71997c98..d97cdf38 100644
--- a/README.md
+++ b/README.md
@@ -19,7 +19,7 @@ Set up services to use only two factor, or public/private authentication
 mechanisms if you really want to protect services.
 
 This README is a quick introduction to Fail2Ban. More documentation, FAQ, and HOWTOs
-available in the fail2ban(1) manpage and on the website https://www.fail2ban.org
+to be found on fail2ban(1) manpage and the website: https://www.fail2ban.org
 
 Installation:
 -------------

From d7e320b96d1339d19331d4cad05e77493e1ce669 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Allan=20Nordh=C3=B8y?= <epost@anotheragency.no>
Date: Tue, 23 Jan 2018 21:09:53 +0100
Subject: [PATCH 03/13] reverting linux indentation

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index d97cdf38..0f08b3e6 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,7 @@ Required:
 
 Optional:
 - [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
-- Linux >= 2.6.13
+-  ↓ Linux >= 2.6.13
 - [gamin >= 0.0.21](https://www.gnome.org/~veillard/gamin)
 - [systemd >= 204](https://www.freedesktop.org/wiki/Software/systemd)
 - [dnspython](http://www.dnspython.org/)

From e8ffab28fb8c50c576f0422c726b0b1c04829397 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 13:18:55 +0100
Subject: [PATCH 04/13] filter.d/apache-noscript.conf: extended to match
 "Primary script unknown", got from php-fpm module.

---
 config/filter.d/apache-noscript.conf      | 9 +++++++--
 fail2ban/tests/files/logs/apache-noscript | 2 ++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index fbc1af64..abc083a6 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -17,8 +17,13 @@ before = apache-common.conf
 
 [Definition]
 
-failregex = ^%(_apache_error_client)s ((AH001(28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): /\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)(, referer: \S+)?\s*$
-            ^%(_apache_error_client)s script '/\S*(php([45]|[.-]cgi)?|\.asp|\.exe|\.pl)\S*' not found or unable to stat(, referer: \S+)?\s*$
+script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
+
+prefregex = ^%(_apache_error_client)s <F-CONTENT>.+</F-CONTENT>$
+
+failregex = ^(?:(?:AH001(?:28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <script>\b
+            ^script '<script>\S*' not found or unable to stat
+            ^(?:AH01071: )?Got error 'Primary script unknown\\n'
 
 ignoreregex = 
 
diff --git a/fail2ban/tests/files/logs/apache-noscript b/fail2ban/tests/files/logs/apache-noscript
index 68fc7c0a..91c55571 100644
--- a/fail2ban/tests/files/logs/apache-noscript
+++ b/fail2ban/tests/files/logs/apache-noscript
@@ -16,3 +16,5 @@
 # apache 2.4
 # failJSON: { "time": "2013-12-23T07:49:01", "match": true , "host": "204.232.202.107" }
 [Mon Dec 23 07:49:01.981912 2013] [:error] [pid 3790] [client 204.232.202.107:46301] script '/var/www/timthumb.php' not found or unable to stat
+# failJSON: { "time": "2018-03-11T08:56:20", "match": true , "host": "192.0.2.106", "desc": "php-fpm error" }
+[Sun Mar 11 08:56:20.913548 2018] [proxy_fcgi:error] [pid 742:tid 140142593419008] [client 192.0.2.106:50900] AH01071: Got error 'Primary script unknown\n'
\ No newline at end of file

From 8763cf0a362e507dc664928b0e74306d5b9f4150 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 14:26:51 +0100
Subject: [PATCH 05/13] ChangeLog updated

---
 ChangeLog | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ChangeLog b/ChangeLog
index ceb3c822..238bf56c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -48,6 +48,7 @@ ver. 0.10.3-dev-1 (20??/??/??) - development edition
 ### New Features
 
 ### Enhancements
+* `filter.d/apache-noscript.conf`: extend failregex to match "Primary script unknown", e. g. from php-fpm (gh-2073);
 * date-detector extended with long epoch (`LEPOCH`) to parse milliseconds/microseconds posix-dates (gh-2029);
 * possibility to specify own regex-pattern to match epoch date-time, e. g. `^\[{EPOCH}\]` or `^\[{LEPOCH}\]` (gh-2038);
   the epoch-pattern similar to `{DATE}` patterns does the capture and cuts out the match of whole pattern from the log-line,

From 185cb998e7c7f2509830bed4a9f2fe6179f77e7b Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 14:38:47 +0100
Subject: [PATCH 06/13] make `prefregex` more precise in order to avoid catch
 the content for non failure lines

---
 config/filter.d/apache-noscript.conf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index abc083a6..8858d635 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -19,11 +19,11 @@ before = apache-common.conf
 
 script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
 
-prefregex = ^%(_apache_error_client)s <F-CONTENT>.+</F-CONTENT>$
+prefregex = ^%(_apache_error_client)s <F-CONTENT>(?:(?:AH0(?:01(?:28|30)|1(?:264|071)): )|(?:(?:[Ff]ile|script|[Gg]ot) )).+</F-CONTENT>$
 
-failregex = ^(?:(?:AH001(?:28|30): )?File does not exist|(AH01264: )?script not found or unable to stat): <script>\b
+failregex = ^(?:(?:AH001(?:28|30): )?[Ff]ile does not exist|(AH01264: )?script not found or unable to stat): <script>\b
             ^script '<script>\S*' not found or unable to stat
-            ^(?:AH01071: )?Got error 'Primary script unknown\\n'
+            ^(?:AH01071: )?[Gg]ot error '[Pp]rimary script unknown\\n'
 
 ignoreregex = 
 

From 7b3442c4e205fe04edcfa610b037193a9ddbead3 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Mon, 19 Mar 2018 14:53:56 +0100
Subject: [PATCH 07/13] amend to 185cb998e7c7f2509830bed4a9f2fe6179f77e7b:
 capture error prefix outside of the failure content;

---
 config/filter.d/apache-noscript.conf | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/filter.d/apache-noscript.conf b/config/filter.d/apache-noscript.conf
index 8858d635..1963d1dd 100644
--- a/config/filter.d/apache-noscript.conf
+++ b/config/filter.d/apache-noscript.conf
@@ -19,11 +19,11 @@ before = apache-common.conf
 
 script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl)
 
-prefregex = ^%(_apache_error_client)s <F-CONTENT>(?:(?:AH0(?:01(?:28|30)|1(?:264|071)): )|(?:(?:[Ff]ile|script|[Gg]ot) )).+</F-CONTENT>$
+prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
 
-failregex = ^(?:(?:AH001(?:28|30): )?[Ff]ile does not exist|(AH01264: )?script not found or unable to stat): <script>\b
-            ^script '<script>\S*' not found or unable to stat
-            ^(?:AH01071: )?[Gg]ot error '[Pp]rimary script unknown\\n'
+failregex = ^(?:does not exist|not found or unable to stat): <script>\b
+            ^'<script>\S*' not found or unable to stat
+            ^error '[Pp]rimary script unknown\\n'
 
 ignoreregex = 
 

From 6dc9c23a25489aa2f88300596b49dbe69d56887c Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <github@sebres.de>
Date: Tue, 20 Mar 2018 23:14:43 +0100
Subject: [PATCH 08/13] fixed typo in pragma-comment

---
 fail2ban/tests/utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fail2ban/tests/utils.py b/fail2ban/tests/utils.py
index 901952eb..12d2ac03 100644
--- a/fail2ban/tests/utils.py
+++ b/fail2ban/tests/utils.py
@@ -680,7 +680,7 @@ class LogCaptureTestCase(unittest.TestCase):
 				return self._val
 			# try to lock, if not possible - return cached/empty (max 5 times):
 			lck = self._lock.acquire(False)
-			if not lck: # pargma: no cover (may be too sporadic on slow systems)
+			if not lck: # pragma: no cover (may be too sporadic on slow systems)
 				self._nolckCntr += 1
 				if self._nolckCntr <= 5:
 					return self._val if self._val is not None else ''

From 79019967a79518d4b72c91dba31dff1433497934 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Tue, 20 Mar 2018 23:34:18 +0100
Subject: [PATCH 09/13] datepattern: fix epoch/long-epoch name, if custom
 pattern specified

---
 fail2ban/server/datetemplate.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fail2ban/server/datetemplate.py b/fail2ban/server/datetemplate.py
index 606ba6ec..e032c2b0 100644
--- a/fail2ban/server/datetemplate.py
+++ b/fail2ban/server/datetemplate.py
@@ -207,12 +207,12 @@ class DateEpoch(DateTemplate):
 
 	def __init__(self, lineBeginOnly=False, pattern=None, longFrm=False):
 		DateTemplate.__init__(self)
-		self.name = "Epoch"
+		self.name = "Epoch" if not pattern else pattern
 		self._longFrm = longFrm;
 		self._grpIdx = 1
 		epochRE = r"\d{10,11}\b(?:\.\d{3,6})?"
 		if longFrm:
-			self.name = "LongEpoch";
+			self.name = "LongEpoch" if not pattern else pattern
 			epochRE = r"\d{10,11}(?:\d{3}(?:\.\d{1,6}|\d{3})?)?"
 		if pattern:
 			# pattern should capture/cut out the whole match:

From 218905c924b4cde3408ebd7b399712f08ec33b19 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Thu, 22 Mar 2018 10:16:40 +0100
Subject: [PATCH 10/13] performance optimization: findFailure, search regex
 etc, handling with buffer/tuple-lines optimized (especially multi-regex resp.
 multi-lines filters)

---
 fail2ban/server/failregex.py | 13 +++++-
 fail2ban/server/filter.py    | 88 +++++++++++++++++++-----------------
 2 files changed, 57 insertions(+), 44 deletions(-)

diff --git a/fail2ban/server/failregex.py b/fail2ban/server/failregex.py
index d5c9345f..40d106db 100644
--- a/fail2ban/server/failregex.py
+++ b/fail2ban/server/failregex.py
@@ -185,6 +185,13 @@ class Regex:
 	def getRegex(self):
 		return self._regex
 	
+	##
+	# Returns string buffer using join of the tupleLines.
+	#
+	@staticmethod
+	def _tupleLinesBuf(tupleLines):
+		return "\n".join(map(lambda v: "".join(v[::2]), tupleLines)) + "\n"
+
 	##
 	# Searches the regular expression.
 	#
@@ -194,8 +201,10 @@ class Regex:
 	# @param a list of tupples. The tupples are ( prematch, datematch, postdatematch )
 	
 	def search(self, tupleLines, orgLines=None):
-		self._matchCache = self._regexObj.search(
-			"\n".join("".join(value[::2]) for value in tupleLines) + "\n")
+		buf = tupleLines
+		if not isinstance(tupleLines, basestring):
+			buf = Regex._tupleLinesBuf(tupleLines)
+		self._matchCache = self._regexObj.search(buf)
 		if self._matchCache:
 			if orgLines is None: orgLines = tupleLines
 			# if single-line:
diff --git a/fail2ban/server/filter.py b/fail2ban/server/filter.py
index 5b9125ed..0ba54be0 100644
--- a/fail2ban/server/filter.py
+++ b/fail2ban/server/filter.py
@@ -582,8 +582,9 @@ class Filter(JailThread):
 	# @return: a boolean
 
 	def ignoreLine(self, tupleLines):
+		buf = Regex._tupleLinesBuf(tupleLines)
 		for ignoreRegexIndex, ignoreRegex in enumerate(self.__ignoreRegex):
-			ignoreRegex.search(tupleLines)
+			ignoreRegex.search(buf, tupleLines)
 			if ignoreRegex.hasMatched():
 				return ignoreRegexIndex
 		return None
@@ -626,6 +627,7 @@ class Filter(JailThread):
 	def findFailure(self, tupleLine, date=None):
 		failList = list()
 
+		ll = logSys.getEffectiveLevel()
 		returnRawHost = self.returnRawHost
 		cidr = IPAddr.CIDR_UNSPEC
 		if self.__useDns == "raw":
@@ -635,7 +637,7 @@ class Filter(JailThread):
 		# Checks if we mut ignore this line.
 		if self.ignoreLine([tupleLine[::2]]) is not None:
 			# The ignoreregex matched. Return.
-			logSys.log(7, "Matched ignoreregex and was \"%s\" ignored",
+			if ll <= 7: logSys.log(7, "Matched ignoreregex and was \"%s\" ignored",
 				"".join(tupleLine[::2]))
 			return failList
 
@@ -662,7 +664,7 @@ class Filter(JailThread):
 			date = self.__lastDate
 
 		if self.checkFindTime and date is not None and date < MyTime.time() - self.getFindTime():
-			logSys.log(5, "Ignore line since time %s < %s - %s", 
+			if ll <= 5: logSys.log(5, "Ignore line since time %s < %s - %s", 
 				date, MyTime.time(), self.getFindTime())
 			return failList
 
@@ -671,58 +673,60 @@ class Filter(JailThread):
 				self.__lineBuffer + [tupleLine[:3]])[-self.__lineBufferSize:]
 		else:
 			orgBuffer = self.__lineBuffer = [tupleLine[:3]]
-		logSys.log(5, "Looking for match of %r", self.__lineBuffer)
+		if ll <= 5: logSys.log(5, "Looking for match of %r", self.__lineBuffer)
+		buf = Regex._tupleLinesBuf(self.__lineBuffer)
 
 		# Pre-filter fail regex (if available):
 		preGroups = {}
 		if self.__prefRegex:
-			if logSys.getEffectiveLevel() <= logging.HEAVYDEBUG: # pragma: no cover
-				logSys.log(5, "  Looking for prefregex %r", self.__prefRegex.getRegex())
-			self.__prefRegex.search(self.__lineBuffer)
+			if ll <= 5: logSys.log(5, "  Looking for prefregex %r", self.__prefRegex.getRegex())
+			self.__prefRegex.search(buf, self.__lineBuffer)
 			if not self.__prefRegex.hasMatched():
-				logSys.log(5, "  Prefregex not matched")
+				if ll <= 5: logSys.log(5, "  Prefregex not matched")
 				return failList
 			preGroups = self.__prefRegex.getGroups()
-			logSys.log(7, "  Pre-filter matched %s", preGroups)
+			if ll <= 7: logSys.log(7, "  Pre-filter matched %s", preGroups)
 			repl = preGroups.get('content')
 			# Content replacement:
 			if repl:
 				del preGroups['content']
-				self.__lineBuffer = [('', '', repl)]
+				self.__lineBuffer, buf = [('', '', repl)], None
 
 		# Iterates over all the regular expressions.
 		for failRegexIndex, failRegex in enumerate(self.__failRegex):
-			if logSys.getEffectiveLevel() <= logging.HEAVYDEBUG: # pragma: no cover
-				logSys.log(5, "  Looking for failregex %d - %r", failRegexIndex, failRegex.getRegex())
-			failRegex.search(self.__lineBuffer, orgBuffer)
-			if not failRegex.hasMatched():
-				continue
-			# The failregex matched.
-			logSys.log(7, "  Matched failregex %d: %s", failRegexIndex, failRegex.getGroups())
-			# Checks if we must ignore this match.
-			if self.ignoreLine(failRegex.getMatchedTupleLines()) \
-					is not None:
-				# The ignoreregex matched. Remove ignored match.
-				self.__lineBuffer = failRegex.getUnmatchedTupleLines()
-				logSys.log(7, "  Matched ignoreregex and was ignored")
-				if not self.checkAllRegex:
-					break
-				else:
-					continue
-			if date is None:
-				logSys.warning(
-					"Found a match for %r but no valid date/time "
-					"found for %r. Please try setting a custom "
-					"date pattern (see man page jail.conf(5)). "
-					"If format is complex, please "
-					"file a detailed issue on"
-					" https://github.com/fail2ban/fail2ban/issues "
-					"in order to get support for this format.",
-					 "\n".join(failRegex.getMatchedLines()), timeText)
-				continue
-			self.__lineBuffer = failRegex.getUnmatchedTupleLines()
-			# retrieve failure-id, host, etc from failure match:
 			try:
+				# buffer from tuples if changed: 
+				if buf is None:
+					buf = Regex._tupleLinesBuf(self.__lineBuffer)
+				if ll <= 5: logSys.log(5, "  Looking for failregex %d - %r", failRegexIndex, failRegex.getRegex())
+				failRegex.search(buf, orgBuffer)
+				if not failRegex.hasMatched():
+					continue
+				# The failregex matched.
+				if ll <= 7: logSys.log(7, "  Matched failregex %d: %s", failRegexIndex, failRegex.getGroups())
+				# Checks if we must ignore this match.
+				if self.ignoreLine(failRegex.getMatchedTupleLines()) \
+						is not None:
+					# The ignoreregex matched. Remove ignored match.
+					self.__lineBuffer, buf = failRegex.getUnmatchedTupleLines(), None
+					if ll <= 7: logSys.log(7, "  Matched ignoreregex and was ignored")
+					if not self.checkAllRegex:
+						break
+					else:
+						continue
+				if date is None:
+					logSys.warning(
+						"Found a match for %r but no valid date/time "
+						"found for %r. Please try setting a custom "
+						"date pattern (see man page jail.conf(5)). "
+						"If format is complex, please "
+						"file a detailed issue on"
+						" https://github.com/fail2ban/fail2ban/issues "
+						"in order to get support for this format.",
+						 "\n".join(failRegex.getMatchedLines()), timeText)
+					continue
+				self.__lineBuffer, buf = failRegex.getUnmatchedTupleLines(), None
+				# retrieve failure-id, host, etc from failure match:
 				raw = returnRawHost
 				if preGroups:
 					fail = preGroups.copy()
@@ -735,7 +739,7 @@ class Filter(JailThread):
 					fail = self._mergeFailure(mlfid, fail, failRegex)
 					# bypass if no-failure case:
 					if fail.get('nofail'):
-						logSys.log(7, "Nofail by mlfid %r in regex %s: %s",
+						if ll <= 7: logSys.log(7, "Nofail by mlfid %r in regex %s: %s",
 							mlfid, failRegexIndex, fail.get('mlfforget', "waiting for failure"))
 						if not self.checkAllRegex: return failList
 				else:
@@ -764,7 +768,7 @@ class Filter(JailThread):
 						cidr = IPAddr.CIDR_RAW
 				# if mlfid case (not failure):
 				if host is None:
-					logSys.log(7, "No failure-id by mlfid %r in regex %s: %s",
+					if ll <= 7: logSys.log(7, "No failure-id by mlfid %r in regex %s: %s",
 						mlfid, failRegexIndex, fail.get('mlfforget', "waiting for identifier"))
 					if not self.checkAllRegex: return failList
 					ips = [None]

From 9710c8c996916fd32cf103a4b8877ca57bceef7a Mon Sep 17 00:00:00 2001
From: "Sergey G. Brester" <github@sebres.de>
Date: Thu, 22 Mar 2018 11:43:15 +0100
Subject: [PATCH 11/13] minor fix with reindent

---
 README.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 0f08b3e6..3b51387a 100644
--- a/README.md
+++ b/README.md
@@ -31,12 +31,14 @@ Required:
 - [Python2 >= 2.6 or Python >= 3.2](https://www.python.org) or [PyPy](https://pypy.org)
 
 Optional:
-- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify)
--  ↓ Linux >= 2.6.13
-- [gamin >= 0.0.21](https://www.gnome.org/~veillard/gamin)
-- [systemd >= 204](https://www.freedesktop.org/wiki/Software/systemd)
+- [pyinotify >= 0.8.3](https://github.com/seb-m/pyinotify), may require:
+  * Linux >= 2.6.13
+- [gamin >= 0.0.21](http://www.gnome.org/~veillard/gamin)
+- [systemd >= 204](http://www.freedesktop.org/wiki/Software/systemd) and python bindings:
+  * [python-systemd package](https://www.freedesktop.org/software/systemd/python-systemd/index.html)
 - [dnspython](http://www.dnspython.org/)
 
+
 To install:
 
     tar xvfj fail2ban-0.9.7.tar.bz2

From fd0471927d4428e4aafe881b847faf8a0ba1c311 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Tue, 3 Apr 2018 11:53:03 +0200
Subject: [PATCH 12/13] badips: increase age for /list/cat in the test-cases
 (default 24h is too short, so the tests can sporadic fail)

---
 fail2ban/tests/action_d/test_badips.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fail2ban/tests/action_d/test_badips.py b/fail2ban/tests/action_d/test_badips.py
index 781d0b05..4d1b5863 100644
--- a/fail2ban/tests/action_d/test_badips.py
+++ b/fail2ban/tests/action_d/test_badips.py
@@ -58,6 +58,7 @@ if sys.version_info >= (2,7): # pragma: no cover - may be unavailable
 			self.jail.actions.add("badips", pythonModuleName, initOpts={
 				'category': "ssh",
 				'banaction': "test",
+				'age': "2w",
 				'score': 5,
 				'key': "fail2ban-test-suite",
 				#'bankey': "fail2ban-test-suite",

From 50d7c649ba63b5ec978461f82649dae8f4e38f32 Mon Sep 17 00:00:00 2001
From: sebres <serg.brester@sebres.de>
Date: Tue, 3 Apr 2018 12:39:37 +0200
Subject: [PATCH 13/13] Skip several test-cases of systemd backend, if journal
 seems to be not available (e. g. no rights to read journal); Closes gh-2100

---
 fail2ban/tests/filtertestcase.py | 35 +++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/fail2ban/tests/filtertestcase.py b/fail2ban/tests/filtertestcase.py
index ec839585..3e3abed2 100644
--- a/fail2ban/tests/filtertestcase.py
+++ b/fail2ban/tests/filtertestcase.py
@@ -1145,6 +1145,7 @@ def get_monitor_failures_journal_testcase(Filter_): # pragma: systemd no cover
 		def setUp(self):
 			"""Call before every test case."""
 			super(MonitorJournalFailures, self).setUp()
+			self._runtimeJournal = None
 			self.test_file = os.path.join(TEST_FILES_DIR, "testcase-journal.log")
 			self.jail = DummyJail()
 			self.filter = None
@@ -1156,6 +1157,7 @@ def get_monitor_failures_journal_testcase(Filter_): # pragma: systemd no cover
 				'TEST_FIELD': "1", 'TEST_UUID': self.test_uuid}
 
 		def _initFilter(self, **kwargs):
+			self._getRuntimeJournal() # check journal available
 			self.filter = Filter_(self.jail, **kwargs)
 			self.filter.addJournalMatch([
 				"SYSLOG_IDENTIFIER=fail2ban-testcases",
@@ -1176,21 +1178,26 @@ def get_monitor_failures_journal_testcase(Filter_): # pragma: systemd no cover
 		def _getRuntimeJournal(self):
 			"""Retrieve current system journal path
 
-			If none found, None will be returned
+			If not found, SkipTest exception will be raised.
 			"""
-			# Depending on the system, it could be found under /run or /var/log (e.g. Debian)
-			# which are pointed by different systemd-path variables.  We will
-			# check one at at time until the first hit
-			for systemd_var in 'system-runtime-logs', 'system-state-logs':
-				tmp = Utils.executeCmd(
-					'find "$(systemd-path %s)" -name system.journal' % systemd_var,
-					timeout=10, shell=True, output=True
-				)
-				self.assertTrue(tmp)
-				out = str(tmp[1].decode('utf-8')).split('\n')[0]
-				if out:
-					return out
-
+			# we can cache it:
+			if self._runtimeJournal is None:
+				# Depending on the system, it could be found under /run or /var/log (e.g. Debian)
+				# which are pointed by different systemd-path variables.  We will
+				# check one at at time until the first hit
+				for systemd_var in 'system-runtime-logs', 'system-state-logs':
+					tmp = Utils.executeCmd(
+						'find "$(systemd-path %s)" -name system.journal' % systemd_var,
+						timeout=10, shell=True, output=True
+					)
+					self.assertTrue(tmp)
+					out = str(tmp[1].decode('utf-8')).split('\n')[0]
+					if out: break
+				self._runtimeJournal = out
+			if self._runtimeJournal:
+				return self._runtimeJournal
+			raise unittest.SkipTest('systemd journal seems to be not available (e. g. no rights to read)')
+		
 		def testJournalFilesArg(self):
 			# retrieve current system journal path
 			jrnlfile = self._getRuntimeJournal()