Asterisk 13 + fail2ban (Debian)

Добрый день!

Не получается настроить fail2ban. Подскажите, пожалуйста, в чем может быть проблема. Делал по различным статьям. Возможно намешал всего подрят... Буду благодарен за любую подсказку!

Лог астера:

[2017-02-08 10:38:51] WARNING[26902]: chan_sip.c:4120 retrans_pkt: Timeout on 41df6fd224fa186e31ce9c8c573f8d0d on non-critical invite transaction.
[2017-02-08 10:40:57] SECURITY[26919]: res_security_log.c:116 security_event_stasis_cb: SecurityEvent="ChallengeSent",EventTV="2017-02-08T10:40:57.003+0600",Severity="Informational",Service="SIP",EventVersion="1",AccountID="sip:99901@185.22.**.**",SessionID="0x7f7b40014c00",LocalAddress="IPV4/UDP/185.22.**.**/5060",RemoteAddress="IPV4/UDP/193.111.140.133/5074",Challenge="044e4d23"
[2017-02-08 10:41:29] WARNING[26902]: chan_sip.c:4120 retrans_pkt: Timeout on 2ad47a7da4865a42d2fe6c7b7a2669f0 on non-critical invite transaction.
[2017-02-08 10:43:29] SECURITY[26919]: res_security_log.c:116 security_event_stasis_cb: SecurityEvent="ChallengeSent",EventTV="2017-02-08T10:43:29.417+0600",Severity="Informational",Service="SIP",EventVersion="1",AccountID="sip:99901@185.22.**.**",SessionID="0x7f7b40014c00",LocalAddress="IPV4/UDP/185.22.**.**/5060",RemoteAddress="IPV4/UDP/193.111.140.133/5070",Challenge="34ff0e95"
[2017-02-08 10:44:01] WARNING[26902]: chan_sip.c:4120 retrans_pkt: Timeout on 3b6af71165c6d4a9d7c66a983702f19b on non-critical invite transaction.
[2017-02-08 10:46:08] SECURITY[26919]: res_security_log.c:116 security_event_stasis_cb: SecurityEvent="ChallengeSent",EventTV="2017-02-08T10:46:08.131+0600",Severity="Informational",Service="SIP",EventVersion="1",AccountID="sip:99901@185.22.**.**",SessionID="0x7f7b40014c00",LocalAddress="IPV4/UDP/185.22.**.**/5060",RemoteAddress="IPV4/UDP/193.111.140.133/5074",Challenge="07684d8e"
[2017-02-08 10:46:40] WARNING[26902]: chan_sip.c:4120 retrans_pkt: Timeout on eafc5d3550b13213503c1c77ba307fca on non-critical invite transaction.

jail.conf:

[asterisk-iptables]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
logpath  = /var/log/asterisk/messages
maxretry = 1
findtime = 21600
bantime = 864000

[asterisk-tcp]

enabled  = true
filter   = asterisk
port     = 5060,5061
protocol = tcp
logpath  = /var/log/asterisk/messages

[asterisk-udp]

enabled  = true
filter   = asterisk
port     = 5060,5061
protocol = udp
logpath  = /var/log/asterisk/messages

fw

iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-asterisk-udp  udp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061
fail2ban-asterisk-tcp  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 5060,5061
fail2ban-ASTERISK  all  --  0.0.0.0/0            0.0.0.0/0           
fail2ban-ssh  tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22

logger.conf

[general]
dateformat=%F %T
console => notice,warning,error,security
messages => security,notice,warning,error

filter.d/asterisk.conf

[INCLUDES]

before = common.conf

[Definition]

log_prefix= \[\]\s*(?:NOTICE|SECURITY)%(__pid_re)s:?(?:\[\S+\d*\])? \S+:\d*

failregex = ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Wrong password$
            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - No matching peer found$
            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Username/auth name mismatch$
            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Device does not match ACL$
            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Peer is not supposed to register$
            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - ACL error \(permit/deny\)$
            ^%(log_prefix)s Registration from '[^']*' failed for '<HOST>(:\d+)?' - Not a local domain$
            ^%(log_prefix)s Call from '[^']*' \(<HOST>:\d+\) to extension '\d+' rejected because extension not found in context 'default'\.$
            ^%(log_prefix)s Host <HOST> failed to authenticate as '[^']*'$
            ^%(log_prefix)s No registration for peer '[^']*' \(from <HOST>\)$
            ^%(log_prefix)s Host <HOST> failed MD5 authentication for '[^']*' \([^)]+\)$
            ^%(log_prefix)s Failed to authenticate (user|device) [^@]+@<HOST>\S*$
            ^%(log_prefix)s (?:handle_request_subscribe: )?Sending fake auth rejection for (device|user) \d*<sip:[^@]+@<HOST>>;tag=\w+\S*$
            ^%(log_prefix)s SecurityEvent="(FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword)",EventTV="[\d-]+",Severity="[\w]+",Service="[\w]+",EventVersion="\d+",AccountID="\d+",SessionID="0x[\da-f]+",LocalAddress="IPV[46]/(UD|TC)P/[\da-fA-F:.]+/\d+",RemoteAddress="IPV[46]/(UD|TC)P/<HOST>/\d+"(,Challenge="\w+",ReceivedChallenge="\w+")?(,ReceivedHash="[\da-f]+")?$

ignoreregex =

filter.d/asterisk-security.conf

[INCLUDES]

[Definition]

failregex = NOTICE.* .*: No registration for peer '.*' \(from <HOST>\)
    NOTICE.* .*: Host <HOST> failed MD5 authentication for '.*' \(.*\)
    NOTICE.* .*: Host <HOST> denied access to register peer '.*'
    NOTICE.* .*: Host <HOST> did not provide proper plaintext password for '.*'
    NOTICE.* .*: Registration of '.*' rejected: '.*' from: '<HOST>'
    NOTICE.* .*: Peer '.*' is not dynamic (from <HOST>)
    NOTICE.* .*: Host <HOST> denied access to register peer '.*'
#
    WARNING.* .*: .*Rejecting unknown SIP connection from <HOST>.*
    WARNING.* Ext. s: Friendly Scanner from <HOST>
#
    SECURITY.* .*: SecurityEvent="InvalidAccountID".*,Severity="Error",Service="(SIP|AMI)".*,RemoteAddress="IPV[46]\/(UDP|TCP|TLS)\/<HOST>\/[0-9]+"
    SECURITY.* .*: SecurityEvent="FailedACL".*,Severity="Error",Service="(SIP|AMI)".*,RemoteAddress="IPV[46]\/(UDP|TCP|TLS)\/<HOST>\/[0-9]+"
    SECURITY.* .*: SecurityEvent="InvalidPassword",.*,Severity="Error",Service="[a-zA-Z]+",.*,RemoteAddress="IPV[46]/(UDP|TCP|TLS)/<HOST>/[0-9]+"
    SECURITY.* .*: SecurityEvent="ChallengeResponseFailed".*,Severity="Error",Service="(SIP|AMI)".*,RemoteAddress="IPV[46]\/(UDP|TCP|TLS)\/<HOST>\/[0-9]+"

#VERBOSE.* logger.c: -- .*IP/<HOST>-.* Playing 'ss-noservice' \(language '.*'\)

ignoreregex =

fail2ban.log

tail -f /var/log/fail2ban.log 
2017-02-08 09:46:02,745 fail2ban.filter [27171]: INFO    Added logfile = /var/log/asterisk/messages
2017-02-08 09:46:02,745 fail2ban.filter [27171]: INFO    Set maxRetry = 2
2017-02-08 09:46:02,747 fail2ban.filter [27171]: INFO    Set findtime = 600
2017-02-08 09:46:02,747 fail2ban.actions[27171]: INFO    Set banTime = 360000
2017-02-08 09:46:02,760 fail2ban.jail   [27171]: INFO    Jail 'ssh' started
2017-02-08 09:46:02,763 fail2ban.jail   [27171]: INFO    Jail 'asterisk-iptables' started
2017-02-08 09:46:02,765 fail2ban.jail   [27171]: INFO    Jail 'asterisk-tcp' started
2017-02-08 09:46:02,766 fail2ban.jail   [27171]: INFO    Jail 'asterisk-udp' started
2017-02-08 09:46:57,029 fail2ban.filter [27171]: ERROR   Error in FilterPyinotify callback: 'module' object has no attribute '_strptime_time'
2017-02-08 09:46:57,030 fail2ban.filter [27171]: ERROR   Error in FilterPyinotify callback: 'module' object has no attribute '_strptime_time'