Fail2ban log size

Fail2ban log size. As well as ensuring all modules are up to date. [2] It is able to run on POSIX systems that have an interface to a packet-control system or firewall installed locally, such as iptables or TCP Wrapper . log stopped rotating 6 months ago, the log size is now over 3GB (I believe this was related to my CentOS 7 to Alma 8 upgrade using Alma Elevate). Conclusion. Jan 15, 2024 · Step 2 — Configuring Fail2ban. 000 drops a minute this week. 3. elvislives October 17, 2017, 2:11pm 1. See also my article: May 7, 2014 · Fail2Ban 0. To ensure that Fail2ban runs on system startup, use the following command: sudo systemctl enable fail2ban. Where you can find it you could look in fail2ban. log file: preferably obtained while running fail2ban with loglevel = 4 Sep 7, 2020 · All I see on the fail2ban log is entries like this. The application is rotating the logs based on a size setting and is naming the logs by appending the date. Each time the new Logging ¶. This is why you don't see the issue 0. Oct 17, 2023 · I noticed that my fail2ban. 2. conf or remove it and place this content into jail. Mar 15, 2023 · Fail2Ban scans log files like /var/log/auth. However in the /var/log/fail2ban. bantime = -1. log: This line specifies the log file (/var/log/auth. sudo apt-get install fail2ban. d. The simplest way to get started is to run the wrapper script straight from the root of the repo (assuming you have logs in default /var/log/) . To change settings of an existing jail: Log in to Plesk. The line is still being processed fully in Python 2, and in Python 3 is merely drops the characters it can't decode. Dec 4, 2023 · Step 4: Configuring Fail2Ban for SSH. Maybe the warning message should be clearer Oct 30, 2017 · I'm running an Ubuntu 16. log is readable, by default it probably isn’t. Fail2Ban v0. Below you can find a short introduction to the available tools and steps for analyzing existing filters on your server. You can view the IP addresses blocked by Fail2ban with the following command. You can configure Fail2Ban using the files in /etc/fail2ban. log as well as my external syslog server, but I'm not sure how to do this. log and bans IP addresses conducting too many failed login attempts. /var/log/asterisk/fail2ban is being created by the FreePBX 15 logfiles module. I installed 2 separate brand new FreePBX16 instances from a 1 click droplet in digitalocean, and both of them seem to have this issue with fail2ban producing so much unnecessary log that it ends up taking up most of the disk space. The config file for Log2RAM is stored at “ /etc/log2ram. Next, open the jail. Instead, we'll copy the jail. When we create the set maybe we need to increase the hash. Oct 19, 2021 · 这里先简单说说 fail2ban 这款工具，其实 Linux 用户可能都不会陌生，fail2ban 是一款入侵检测系统框架工具，通过扫描日志文件并用正则匹配分析，然后通过更新防火墙规则来禁止某些有恶意迹象的 IP（密码失败过多，寻求漏洞利用等）来提高服务器安全性。 Jan 18, 2021 · What I am not sure about is does the /var/log/atsrerisk/fail2ban file size growth happen only as a result of the continues attempts to log on from hackers 51 1699×587 49 KB Or does the pause in fail2ban service allow the file to start to grow and its the size of the file growing going forward that causes the continued failure? fail2ban-client. log also shows the IP as "banned". : Apache web server ones. I also have Graylog running on a separate server on my LAN. e. Getting blocked by any fail2ban rule will block ssh, www, and phones registering if you don’t have your ip in the /etc/fail2ban/jail. To check the status of a jail, e. option dbpurgeage = it is not solution, it is temporary, not garanted workaround. Monitoring Fail2ban Logs in Real-Time. On the next screen you should select a Time Filter. It is possible to configure the server using commands sent to it by fail2ban-client. There is no “one size fits all Jan 22, 2019 · To create an index pattern manually, go to Management → Kibana → Index patterns → Create index pattern. log on a daily basis. head -20 jail. Nov 16, 2020 · Going to the relevant Fail2ban folder: cd /etc/fail2ban/filter. The fail2ban-client allows monitoring jails (reload, restart, status, etc. log; process_events() gets run, pulls the event for which there is no longer a watcher? If so, is there some way we can make sure all of the events are processed before deleting the watch? I'm using fail2ban. log finds nothing. May 10, 2011 · OS, including release name/version: 5. ), to view all available commands: $ fail2ban-client. Aug 19, 2020 · It would appear that another logrotate file is controlling your fail2ban. As Fail2Ban is simply looking at the log files as they are being written to, simply replay them. ignoreip = 127. x supports Python 3, and hence the handling of encoding is required due to Python 3 differentiation between bytes and strings. I have installed fail2ban and not quite sure how I should be setting it up. log file). 1, fail2ban. Mar 10, 2023 · grep "Ban " /var/log/fail2ban. Written in the Python programming language, it is designed to prevent brute-force attacks . 2 file that is 5 months old. We can begin modifying this file using the nano text editor by using the following command. sc description F2BQ "Provides message queue component of fail2ban services for Windows that can reconfigure firewall to reject clients that exceed failed login threshold. log; we delete the watch on /var/log/fail2ban. You need separate loki and promtail instances running to serve the data for Grafana. I then set up a new log rotate with: /var/log/fail2ban. local: # normal (default), ddos, extra or aggressive (combines all). stephdl (Stéphane de Labrusse) February 16, 2020, 8:07am 11. conf(5) manpages for further references. Since iRedMail-1. See full list on linode. It should be available on most linux systems via whatever package manager you prefer. 8. Otherwise log files contain “dovecot: “ prefix, which fail2ban doesn’t like. The problem is that I'm still actually able to login to vaultwarden with my correct password from the "banned" IP. To view all enabled jails: # fail2ban-client status. Feb 26, 2020 · Either rename jail. Sep 5, 2023 · File list: /var/log/auth. fail2ban. I'd like to have fail2ban log itself to /var/log/fail2ban. Within this file, there are two options that you want to take note of. conf ignoreip= field . Changed from the original 86400 seconds. The fail2ban log is quite busy (there is a "filter" entry every two seconds) but iptables shows only a few banned addresses. Jan 10, 2011 · I am running an application that is managing the apache access logs on the server. log) that the "sshd" jail is monitoring for authentication-related events. 191. Fail2Ban installed via OS/distribution mechanisms. Fail2Ban version (including any possible distribution suffixes): v0. Status for the jail: sshd. /fail2ban_analyse_wrapper. Nov 10, 2019 · Answers first: No, this will have no affect. I would like to activate it for SSH and luci login. The filter files included are intended only as a starting point for those who want WPf2b to work “out of the box”. log-20191109 Sep 15, 2021 · are there some entries or errors in fail2ban. Oct 3, 2022 · fail2ban on my pi4 does not ban ssh. actions : WARNING [sshd] xx. conf file to one called jail. I want to send my logs to graylog. ll /var/log/sogo/ ll /var/log/fail2ban ll /var/log/httpd. filter [29045]: INFO [sshd] Found 103. xx. fail2ban-debug. Yum installation: $ sudo yum install fail2ban. Click the jail’s name, and then click Change Settings. conf file in the following areas: [sshd] # To use more aggressive sshd modes set filter parameter "mode" in jail. May 21, 2023 · Fail2Ban is a longstanding python application that scans log files for user-defined regular expressions containing IP addresses, and when a regular expression is found in sufficient numbers over a user-defined time period, performs a user-defined action–typically a ban of the offending IP address. If fail2ban is running, it would be used for asterisk intrusion detection. 2 and I am on Ubuntu Xenial. log ohadbenita (Ohad Benita) November 29, 2017, 1:36pm an event comes into the queue for /var/log/fail2ban. Sep 21, 2020 · This file is generated by Asterisk by config done in System Admin. You have not applied any additional foreign patches to the codebase. Try to login with false credentials how often you need to. before I would be interested by the content of. Stack Exchange network consists of 183 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers. I had the same problem with old bash based custom netfilter firewall solution. dbpurgeage = 7. from the distribution you obtained Fail2Ban from. 5d. Some customizations were done to the configuration (provide details below is so) Stack Exchange Network. Filters ¶. (Optional step) For email support, start the Sendmail installation: apt-get install sendmail-bin sendmail. Once inside the container, locate the Fail2Ban log file. The setup peaked at 214. : Jan 17, 2015 · If fail2ban doesn't recognize your log timestamp, then you have two options: either reconfigure your daemon to log with a timestamp in a more common format, such as in the example log line above; or file a bug report asking to have your timestamp format included. These rules can. [29945]: DEBUG Event queue size: 16 2020-09-07 10:45:07,116 fail2ban. Nov 13, 2022 · maxfailures = 1. Start by creating a copy of the default Fail2Ban configuration file: cp / etc / fail2ban / jail. Then, access the specific FILTER (i. Now, the service will start automatically. d/guacamole-auth. You also set up log rotation to keep your log files from growing indefinitely. d for the fail2ban logs. file >> /path/to/log. Apr 24 05:00:00 srv newsyslog[59281]: logfile turned over due to size>100K. It updates firewall rules to reject the IP address. Edit the jail’s settings and click OK. " 4. Because the warning is really annoying, this was "fixed" in #1542, and namely: [ENH] prevents permanent annoying logging of May 20, 2024 · It’s crucial to monitor and review Fail2Ban logs to ensure your jails are functioning correctly. #. One of these instances has 200+ extensions and thus generates even more log and eventually it stops working Apr 30, 2024 · Open a terminal or command prompt and access the Docker container running Fail2Ban. Our filters fed by fail2ban configs drop 35. 11-3-ARCH Support other date/time formats #1 SMP Fri Jan 29 18:07:27 UTC 2021 armv7l GNU/Linux. 0. You can rename the labels to arbitrary values - the Dashboard supports selection based on labels. If your sshd does not write to auth. fail2ban is not installed and is not wanted. You can try to add -l HEAVYDEBUG parameters fail2ban-regex to see what is happening there. edited Feb 26, 2017 at 20:53. The problem I see is first it unbans all IPs and then it re-adds them, one by one, which is very time consuming. Nov 29, 2017 · Make sure that /var/log/fail2ban. Warning! . docker exec -it <container_name> /bin/bash. login. log there are messages like fail2ban. Don't specify logpath in default section, it wouldn't work because logpath is mostly specified per jail in corresponding section. 7G fail2ban. If WPf2b doesn’t log an Event, or logs it to the wrong place, fail2ban won’t work as it should. 2+ no longer have this prefix. Jul 7, 2018 · 0. logpath) by this "invalid" config file. 1 my_ip_address_1 my_ip_address_2 my_hostname. Proceed with Fail2ban installation: apt-get install fail2ban. dbpurgeage is 86400 seconds (24hours) Is this size coherent with the activity or is there something going on? Apr 8, 2021 · In some cases, the auth log will swell in size because of an increase in SSH activity. Aug 11, 2022 · Apologies if this is a simple request. v1. sudo chmod a+r /var/log/fail2ban. I have edited the jail. fail2ban-client get loglevel returns Current logging level is 'INFO', and fail2ban-client get logtarget returns Current logging Jan 5, 2021 · Override the default value - overwrites, does not merge logpath = /var/log/auth. fail2ban can be tricky to configure correctly; with so many flavours of Linux it’s impossible to provide anything but general guidance. 2 in one of my systems includes this rule: ^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>: 11: And Fail2Ban v0. It comes with a ton of pre-defined filter rules for all kinds of different application logs At the moment, Fail2Ban depends on log lines to have time stamps. 3. Bisects to dfc866e. Set “@timestamp” from the drop-down menu. examp Feb 29, 2024 · Confirm that your system is updated and ready: apt-get update && apt-get upgrade -y. There is a 1. log or fail2ban. Jan 23, 2024 · And then in fail2ban log: 2024-01-23 10:54:18,765 fail2ban. How can I make it work so that my script runs against the fail2ban log before sending it to syslog with rsyslog? Sep 6, 2017 · It doesn't seem to be getting addressed: Nginx SSL access logs not rotated according to GUI settings -- fail2ban suffers For your questions: Rotate log files: When a log file reaches a certain size, OR when a log file is a certain age, it is "rotated" by copying the file and starting a new log — a way of archiving logs. You can use the following command to access the shell of the container: 1. log which could explain it? do you see entries like [jail] Found <IP> in fail2ban. Jul 4, 2022 · Step 2 – Configuring Fail2ban. \\ File size: 272kB License: GPL-2. If your Fail2Ban version is outdated, and you can't verify that the issue persists in the recent release, better seek support. As a result, Fail2ban can run into difficulties. 9G fail2ban. local file in a text editor. Feb 20, 2024 · If you find that your FusionPBX web interface isn’t loading then check and see if fail2ban is blocking your ip. After a few attempts, you will see a message that the server refused your connection attempt. and the version of nethserver-fail2ban. rpm -qa nethserver-fail2ban. According to fail2ban-client status everything is running as expected on dovecot, exim, and ssh, but there's no log file in the expected place (/var/log/fail2ban. I wrote a small BASH script that can turn the fail2ban logs to JSON. More precisely, a fail2ban file inside of the asterisk log directory. Observed behavior. May 19, 2021 · This article demonstrates how to configure Fail2Ban to use a MySQL (or MariaDB, etc) as the storage repository for IP blocking records. 3, fail2ban. : failures. Any additional information. conf to jail. This file is overwritten when fail2ban is upgraded, so we'll lose our changes if we make customizations to this file. In the meanwhile it complains about the hashfile, so we need maybe to increase it, probably not related to the number of IP. 5 & fail2ban. After the installation is complete, you can begin configuring Fail2Ban to set up a jail for your SSH server. Go to Tools & Settings > IP Address Banning (Fail2Ban) (under “Security”), and then go to the “Jails” tab. 86. May 14, 2023 · The way fail2ban works is by continuously analyzing log files with regexes and taking action (usually creating a blocking iptables entry for the respective client IP) when certain criteria are met (too many matches for same IP within certain time span). And your date pattern is not matching defaults of fail2ban. Fill out and check ( [x]) the boxes which apply. log Aug 13, 2020 · Here is a test that also seems to correctly show the presence of records: root@chris-travis-development:~# fail2ban-regex --journalmatch='CONTAINER_TAG=nginx' systemd-journal "nginx-botsearch" Running tests ===== Use failregex filter file : nginx-botsearch, basedir: /etc/fail2ban Use datepattern : Default Detectors Use systemd journal Use encoding : UTF-8 Use journal match : CONTAINER_TAG Mar 26, 2017 · Fail2ban is an open source log based IP bouncer. log you can see what the Fail2Ban is blocking. Since it’s not running, it will not be used; just ignore it. Now check the output from iptables -nvL for fail2ban's sshd chain and confirm there is an entry for the offending IP Oct 13, 2020 · Install Fail2Ban by running the following command: sudo apt-get install fail2ban. * files , the size and naming suggests something started up on august 11 with a 10 day retention with dateext set and no size limit, perhaps a few lines from the log might show an unnecessary verbosity but a busy PBX will have lots of logs, identify the logrotate file that is working and modify that to save just 2 days Jun 4, 2018 · As for the size of the /var/log/btmp file you need to enable logrotate for that- look at you logrotate conf file for a similar file being rotated for how to do that- usually in /etc/logrotate. That is why before starting to develop failregex, check if your log line format known to Fail2Ban. : be defined by the user. The fail2ban. log. First of all, your -2019xxxx files have no direct connection to fail2ban. Logging ¶. Relevant parts of /var/log/fail2ban. The available commands are described in the fail2ban-client(1) manpage. for sshd : # fail2ban-client status sshd. conf / etc / fail2ban / jail. To watch the logs live and spot any issues while working on your server, use the tail -f command: tail -f /var/log/fail2ban. 6 days ago · May 24, 2024: Store started jail names in SQL table fail2ban. 9. Click OK. This will install the software. Go to that directory and print the first 20 lines of that file using head -20: cd /etc/fail2ban. If you run iRedAdmin-Pro or your own web admin panel, it will be very easy to check and manage banned IP addresses. There is a file with defaults called jail. 10. Simply because it is invalid. 10 - 2024-01-23 10:54:18 The good news is that fail2ban has spotted the failure, and will have recorded it in its database. exe" DisplayName= "Fail2ban Queue for Windows" type= own start= auto depend= eventlog/MSMQ. 2 includes this one (which is better): Jun 9, 2018 · sudo fail2ban-client status sudo iptables-save | grep fail2ban In the file /var/log/fail2ban. com Jun 9, 2020 · After tracking down the culprit, we found it to be fail2ban. txt. 2, Fail2ban is configured to store banned IP addresses in SQL database. 4" "<HOST>". sudo nano /etc/log2ram. You can control which runtime parameter you have with fail2ban-client -d | grep guacamole, I guess something is not overwritten (e. But there should be a logrotate config in /etc/logrotate. $ head -20 jail. 180. d/guacamole. g. 000 packets a minute coming from around 250. d/ - look at the syslog or yum for the format, and man logrotate will show you all the options. Timestamp errors can be ignored. log), and find / -name fail2ban. My problem is I've having trouble parsing the information in graylog. conf “. log { missingok weekly rotate 4 compress postrotate systemctl restart fail2ban. I can’t seem to put my finger on it so I came here. Now that Fail2Ban and UFW are installed, we can proceed with configuring Fail2Ban to protect SSH on your Debian 12 server. local. But this is not the major possible use case these days. 11) keeps running out of disk space and the issue is the Fail2ban log files. The default log file path is /var/log/fail2ban. This is a concise log of login attempts (both successful and unsuccessful). It is obviously very questionable that fail2ban must ignore such entries Sep 25, 2022 · 1. Feb 7, 2016 · Similarly, how does the size of a log file and the number of different log files monitored by fail2ban impact overall resource usage? As an example, this jail would let someone try 3,600 SSH login passwords a day if they figured out the fail2ban config and adjusted their script timing to accommodate. Fail2Ban can read multiple log files such as sshd or. 1: Hash is full, cannot add more elements. log does too. conf. By following the steps in this guide, you installed and configured the Fail2ban plugin, excluded your local IP address, and tested your work. Once I have done this for exim and Fail2Ban log analyses based on Loki and Promtail. 04 web server (running Webmin). Add the following under the JAIL's already set header ' [Definition]' configuration file VERY end: The fail2ban database on my server is quite large (420MB). They have not even been created by fail2ban in first place. conf Copy. The root issue seems to be that the file Feb 15, 2023 · ssh admin @ your_server_ip_address. Something about the new Basically "in operation mode" means that fail2ban stopped to scan the log backwards, and entered the monitoring mode where it find new messages only, that are currently arriving in log/journal, and fail2ban found this message after scan and knows it is generated right now. log 2. This allow multiple Fail2Ban services (running on multiple servers) to report and use a central IP blocking repository. log \ | grep $ (date +%Y-%m-%d) \ | awk ' {print $NF}' | sort \ | awk ' {print $1," ("$1")"}' \ | logresolve \ | uniq -c | sort -n. jails. Using Fail2ban with Dovecot¶ If you’re using Dovecot v1. C4. Mar 1, 2024 · Check proper F2B restart. Output. , 'rule'), which you would like to set a specific loglevel for via a text editor: vi jail_name_exampple. The first option is “ SIZE “. I have been trying to research the issue myself by various forums, etc. Type in the index name fail2ban-* and click Next step. 35GB fail2ban. . Oct 17, 2017 · Clearing out Fail2ban log files. Sudden 100% CPU usage a few hours after starting the fail2ban service. log-20191102 17G fail2ban. You can do this by cat /path/to/old-log. filterpyinotif [29945]: DEBUG <_RawEvent sc create F2BQ binPath = "C:\F2B\F2BQueue. Any customizations done to /etc/fail2ban/ configuration. The fail2ban service keeps its configuration files in the /etc/fail2ban directory. Also see fail2ban(1) and jail. What do you mean as workaround?. log until restart Fail2ban. You should reset last log position in sqlite-database of fail2ban: simple method would be to delete whole database (but affects all logs, jail, etc). log, maybe it writes to systemd journal (and there is no rsyslog rule targeting auth-messages to auth. This would be probably impossible, because exim writes some binary data (port scanners, intrusions attempts or similar) and it would not match any "proper" encoding you would try to use. Share. Apr 8, 2023 · Hello FreePBX experts, hope everyone is doing great. Apr 23, 2023 · After rotating the log by newsyslog, Fail2ban stops writing the log to the new rotated empty log file /var/log/fail2ban. Copy the time component from the log line and append an IP address to test with following command: . Summary. This pipe is then processed by a script installed to OpenWRT as fail2ban_pptp that transforms it into file /var/log/ppp. /fail2ban-regex "2013-09-19 02:46:12 1. service 1>/dev/null endscript } Oct 23, 2023 · Configuring fail2ban The fail2ban installation contains a default configuration file called jail. # See "tests/files/logs Aug 14, 2015 · Once your Apache server is running and password authentication is enabled, you can go ahead and install fail2ban (we include another repository re-fetch here in case you already had Apache set up in the previous steps): sudo apt-get update. There is no “one size fits all Set the number of failed login attempts. Go to that directory and print the first 20 lines of that file using head -20: $ cd /etc/fail2ban. Note that this will, of-course, insert the old log file into the middle of your new log file, so you might want to rotate log files before and after you Fail2Ban is an intrusion prevention software framework. If the program does not understand that there is a rotation of the log, then the standard method is JC /var/run/fail2ban Generally fail2ban was probably designed with the idea that someone with one IP tries to hack your ssh or some other service. 11. I followed the testing steps listed on the GitHub and tried to login to my vaultwarden using the wrong email address. Delete fail2ban sqlite-database (maybe backup it firstly). My system (FreePBX 13. Oct 4, 2022 · Low CPU usage and responsive fail2ban-client. Improve this answer. Nov 11, 2020 · Shortly, fail2ban searching for a date in log (and one of default date patterns matching that). log captures the attempts and fail2ban. 000 different IPs. xx already banned (xx is hidden because of privacy). Jan 3, 2021 · What version are you using? Fail2Ban comes with a predefined rule about this, included in the common failregex used by all modes. local in root of /etc/fail2ban. Essentially it reads specific logs that you configure and adds abusive requests to IPTables to be dropped. Rotate auth. Ensure curl is installed, and Python3 with matplotlib and geojson modules. Oct 26, 2017 · to solve you jail problem do : fail2ban-client reload look after in the fail2ban log if the jail started well. Check with fail2ban-client status caddy. fail2ban will always append to its logfile fail2ban. 12. Enter a random password when prompted and repeat it a few times. Standard Filters ¶. 1. Jan 28, 2022 · Stack Exchange Network. I do have some basic knowledge of regular expressions but I am struggling with finding the right ones that will suit the fail2ban exim config file. The key concept behind WPf2b is logging Events to syslog. g. So stop fail2ban. 4. Restarting the service doesn't resolve it (I think it parses the same Dovecot log item that causes the 100% CPU usage in the first place). When IP is banned, check with iptables -L that the rule was added in Chain DOCKER-USER and not in Chain f2b-caddy like before. Sep 16, 2015 · /var/log/auth. 1 or older, you need to log via syslog. Actions : This section provides information related to the actions that Fail2ban takes when malicious behavior is detected. I have that setup already using rsyslog. 2. There is no “one size fits all” configuration Mar 10, 2023 · Going beyond the basics with Fail2Ban involves some experience with parsing log files and regular expressions. log { size 30k create 0600 root root rotate 4 } Save and exit the file appropriately. Feb 15, 2020 · rmk: ‘ipset v7. There is no “one size fits all It also configures syslog to create named pipe /var/log/ppp which collects only logs from pptpd and pppd. sh This will run full analysis on all available logs in /var/log, and store full results in outputs and generated web content in web Feb 14, 2024 · Description : Fail2Ban scans log files and bans IP addresses that makes too many password. cat /var/log/fail2ban. Jul 26, 2019 · Version is Fail2Ban v0. 4, fail2ban. file while fail2ban is running. local. service. Here is my recommended settings for an Amazon Linux system. You can use syslogging by setting log_path to empty value in dovecot. log? etc. ”. So it will detected multiple wrong passwords attempts are made, but i can still try unlimited amounts off wrong passwords. 0-or-later Sometimes, fail2ban create huge log file in my Centos 7 server. Aside from using ssh, you can also test the other filter files in Fail2ban by triggering their “fail state. logpath configures which log file fail2ban will monitor (if the jail is configured with file related backend, and it is the case on your side due to Jail 'sshd' uses pyinotify in log. with logrotate. If in doubt go with the defaults - they should work for most systems, and once you understand how the pieces fit together you can revisit this. conf (or dump it via fail2ban-client -d | grep dbfile). The output will be the same as the second report above, but limited to just today's activity rather than the whole logfile. This Dashboard uses loki and promtail to scrape fail2ban logs. 6 files all seem to be truncated. The vaultwarden. By default, Fail2Ban logs can be found at /var/log/fail2ban. As for DB size - 89M is not big, I saw much more larger fail2ban databases. action = hestia[name=MAIL] logpath = /var/log/exim4/mainlog. bv dk kd cr sn td jx kt ai uf