sshd: can't find failed attempts about docker-fail2ban

[crazy-max]

Hi @jribal, what is the distrib and version of your host please ?
The current example for sshd works for me on Debian 9 and uses the default sshd filter provided by Fail2ban. Take a look at the configuration of this filter. Maybe you have to choose a different mode.

[jribal]

Hi @crazy-max, thank you for your answer.

I'm using debian 9.6, almost everything is on default configuration.
Different modes don't work for, all the other modes just capture less lines than aggressive.

Thank you for the configuration link, I will attempt to add a working filter for me.

UPDATE: I found the isssue ! Time needs to be synchronized between host and container. Only one hour difference makes fail2ban blind to errors.

[crazy-max]

@jribal Oh nice catch, I assume you have changed the TZ env var for the container ?

[jribal]

Exactly, I used TZ . I got lucky to find this error, it's hard to spot.