Home › Forums › BlockHosts

Mar 10 15:18:01 domains blockhosts[5599]: ERROR: failed to parse date for ip 189.114.199.51, using now value:#012 time data '

Thu, 2011–Mar–10

hello guys!

I'm having a problem with blockhosts in my syslog and blockhosts.log me the following message appears that the lifetime blockhosts runs.

The following posts:

syslog:

Mar 10 15:21:01 blockhosts domains [5678]: ERROR: failed to parse date ip is 189.114.199.51, using now value: # 012 time date '2011-03-10 15:18:01 LMT 'does not match format '% Y-% m-% d% H:% M:% S% Z'

blockhosts.log:

2.5.0 blockhosts started: 03/10/2011 15:24:01 LMT
ERROR: failed to parse date is ip 189.71.78.68, using now value:
time date '2011-03-10 15:21:01 LMT 'does not match format'% Y-% m-% d% H:% M:% S% Z '
ERROR: failed to parse date ip is 189.114.199.51, using now value:
time date '2011-03-10 15:21:01 LMT 'does not match format'% Y-% m-% d% H:% M:% S% Z '
... loaded / etc / hosts.deny, starting counts: one blocked, watched 2
... loading log file / var / log / syslog, offset: 2062560
... loading log file / var / log / messages, offset: 12873611
... loading log file / var/log/syslog.1, offset: 12789909
... Discarding all host entries older than 08/03/2011 15:24:01 LMT
Notice: count = 62, blocking host: 189.114.199.51
... final counts: one blocked, watched 2

someone has a solution for this error?

‹ blockhosts causes tcp-wrappers to block SIGALRM vsftpd block problem in deny.hosts ›
Thu, 2011-03-10 14:48 — ac

LMT is the problem - how did that get in there?

Looks like blockhosts wrote in the time as LMT timezone in /etc/hosts.allow?
Then when it tries to read it back, python reports error, for example, this fails:

import time
ISO_STRFTIME = "%Y-%m-%d %H:%M:%S %Z"
datestr = '2011-03-10 15:21:01 LMT'
print time.mktime(time.strptime(datestr, ISO_STRFTIME))

Fails with:
ValueError: time data '2011-03-10 15:21:01 LMT' does not match format '%Y-%m-%d %H:%M:%S %Z'

Not sure how LMT got in there in the first place though - when you run a "date" command on your machine, what timezone do you get back? Changing LMT to GMT in above example makes things all work fine.

The consequence is not serious if this was seen only once - it will use correct time from that point on, and everything will work fine. But if seen multiple times, or if all lines in /etc/hosts.allow say LMT, there is different problem - some system call is writing LMT but other system calls cannot read it back. Will require debugging python system calls time.strftime and time.strptime on your system.

Sun, 2011-03-20 10:03 — Anonymous (not verified)

Debian Squeeze 6.0

Hello,

I've the same problem on my stock Debian 6.0 with python2.6 package.

Best regards

Fri, 2011-06-03 10:03 — Anonymous (not verified)

Hi, Same problem here on two

Hi,

Same problem here on two deb testing systems

Fri, 2011-06-03 11:33 — ac

Cam someone help debug this?

LMT is not a real time zone, at least python strptime seems to not like it. But the question is how did that get in the system in the first place?

If someone can try out these things and post results, or send me email at avinash@aczoom.com, will help a lot.

1: Can you post the output of a "date" command? Would like to see what timezone it reports.

2: If that does not show LMT, can you save and run this python script? Save as "t.py" run as "python t.py" for example: 

#!/usr/bin/python
import time
ISO_STRFTIME = "%Y-%m-%d %H:%M:%S %Z"
START_TIME = time.time()
START_TIME_STR = time.strftime(ISO_STRFTIME, time.localtime(START_TIME))
print START_TIME_STR
print time.mktime(time.strptime(START_TIME_STR, ISO_STRFTIME))

3: When there are blocked hosts in /etc/hosts.allow, what is the date shown there?
Look for lines starting with "#bh:", just before the end of the BlockHosts Additions section.
There will only be such lines when some IP address is being blocked.

Thu, 2011-06-16 05:10 — Anonymous (not verified)

Result example with french locale (fr_FR.utf8)

Example of 'date' command:
root@testsrv:~# date
jeudi 16 juin 2011, 10:45:57 (UTC+0200)

Result of Python script:
root@testsrv:~# python test.py
2011-06-16 10:46:10 WEST
Traceback (most recent call last):
File "test.py", line 7, in
print time.mktime(time.strptime(START_TIME_STR, ISO_STRFTIME))
File "/usr/lib/python2.6/_strptime.py", line 454, in _strptime_time
return _strptime(data_string, format)[0]
File "/usr/lib/python2.6/_strptime.py", line 325, in _strptime
(data_string, format))
ValueError: time data '2011-06-16 10:46:10 WEST' does not match format '%Y-%m-%d %H:%M:%S %Z'

Lines in /etc/hosts.allow:
#---- BlockHosts Additions
ALL: xx.xx.xx.xx : deny

#bh: ip: xx.xx.xx.xx : 2 : 2011-06-16 10:47:00 WEST

#bh: logfile: /var/log/proftpd/proftpd.log
#bh: offset: 1073
#bh: first line:Jun 16 10:45:16 testsrv proftpd[985] testsrv.xxxx.xx: ProFTPD 1.3.3a (maint) (built Mon Mar 7 2011 09:07
:58 UTC) standalone mode STARTUP

#---- BlockHosts Additions

Result of /blockhosts.py when an IP is already blocked:
blockhosts 2.5.1 started: 2011-06-16 11:07:29 WEST
Warning: failed to parse date for ip xx.xx.xx.xx, using default time, error was:
time data '2011-06-16 10:52:20 WEST' does not match format '%Y-%m-%d %H:%M:%S %Z'
... loaded /etc/hosts.allow, starting counts: blocked 1, watched 1
... loading log file /var/log/proftpd/proftpd.log, offset: 3851
... discarding all host entries older than 2011-06-16 05:07:29 WEST
Notice: count=8, blocking host: xx.xx.xx.xx
... final counts: blocked 1, watched 1
... sending email notification

Thu, 2011-06-16 07:23 — ac

Python problem - strptime cannot process strftime output

> ValueError: time data '2011-06-16 10:46:10 WEST' does not match format '%Y-%m-%d %H:%M:%S %Z'

Thanks - so that is the problem.
Even when identical format is used, the %Z printed by strftime cannot be read by strptime on the same system.
http://docs.python.org/library/time.html does not say anything about this, so looks like a system or python or C library dependent issue.

This problem has now been fixed, worked around it by not using Python's strptime call.
Fixed in version 2.6.0, latest version is always available at the Download page, description of change:

 * Python strptime problem. On some systems, fails to read time written
   by strftime on same system, get this error:
   ValueError: time data '2011-06-16 10:46:10 WEST' does not match format '%Y-%m-%d %H:%M:%S %Z'
   Code changed to not rely on Python time.strptime anymore, uses epoch UTC
   number of seconds now. The orignal reason for using strftime was to show
   human readable date/time in hosts.allow. That is still done, but in
   hosts.allow comments only.

   Example hosts.allow lines now:
   #--------- IP Address    :count: epoch secs   # local time ------------
   #bh: ip:   10.141.193.46 :   8 : 1308341273.0 # 2011-06-17 16:07:53 EDT
   #bh: ip:  10.102.213.133 :   2 : 1308341245.0 # 2011-06-17 16:07:25 EDT