Fail2ban - unauthorized unblocking of bans, what is the reason?

Question

Burglary protection

Installed fail2ban, configured. Immediately banned a bunch of botnets. But this morning I see in the log fail2ban:
2014-10-21 22:26:21,101 fail2ban.actions: WARNING [ssh] Ban 5.228.57.161
2014-10-21 23:57:28,590 fail2ban.actions: WARNING [ssh] Ban 2014-10-22
01:54:26,427 fail2ban.actions: WARNING [ssh] Ban 115.146.122.183
2014-10-22 02:32:17,326 fail2ban.actions: WARNING [ssh] Ban 122.225.907.117
2 -22 02:48:28,413 fail2ban.actions: WARNING [ssh] Ban 122.225.109.199
2014-10-22 06:09:21,948 fail2ban.actions: WARNING [ssh] Ban 122.225.109.108
2014-10-22 06:59: 46,675 fail2ban.actions: WARNING [ssh] Ban 117.27.158.78
2014-10-22 10:34:53,259 fail2ban.actions: WARNING [ssh] Ban 222.186.55.215
2014-10-22 11:56:18,736 fail2ban.actions: WARNING [ssh] Ban
189.203.240.53
13:37:45,268 fail2ban.server : INFO Stopping all jails
2014-10-22 13:37:45,360 fail2ban.actions: WARNING [ssh] Unban 78.25.122.156
2014-10-22 13:37:45,786 fail2ban.actions: WARNING [ssh] Unban 37.110.31.162
2014-10-22 13:37:45,790 fail2ban.actions: WARNING [ssh] Unban 188.65.234.16
2014-10-22 13:37:45,794 fail2ban.actions: WARNING [ssh] Unban 89.140. 177.34
2014-10-22 13:37:45,798 fail2ban.actions: WARNING [
ssh] Unban
What could it be? Mass removal of bans? Someone hacked the machine and removed the bans?
The time interval in the fail2ban settings is 15 days.
Set banTime = 1296000
What can you tell gentlemen?

Answer 1

The answer is found gentlemen!
Fail2ban clears all ban tables when sending the reboot command by default. Why the truth is not clear.
The logs with the time of removal of bans coincided up to a second, with the time of the actions of the root user, who sent the server to reboot.
So nothing criminal :)

Answer 2

Look at logs of authorization, in system there were new users?