If Fail2Ban is sending thousands of messages, the usual cause is not that bans are failing—it is that one or more jails are using an email action for every ban. Inspect each jail’s action, switch noisy jails to the ban-only action_, and then adjust findtime, maxretry, and bantime in a local override. Test changes with fail2ban-client, then save them in /etc/fail2ban/jail.local or a file under /etc/fail2ban/jail.d/.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Why Fail2Ban can generate an email flood
Fail2Ban evaluates log entries through jails. A jail watches one service, applies a filter, counts failures from each source address, and runs its configured action when the threshold is reached. If that action includes mail, every resulting ban can create a message. A busy internet-facing server can therefore produce a large volume even when the blocking itself is working exactly as configured.
As an Amazon Associate I earn from qualifying purchases.
The important distinction is between the upstream action definitions:
| Action | What it does | Typical use |
|---|---|---|
action_ |
Performs the ban action without the extra WHOIS or log-report email. | Routine protection where the ban itself is sufficient. |
action_mw |
Performs the ban and sends a WHOIS report by email. | Jails whose individual incidents merit address-ownership context. |
action_mwl |
Performs the ban and sends WHOIS information plus matching log lines. | High-value alerts where an operator needs evidence in each message. |
Those names are action templates; the installed package can select a particular firewall or other ban mechanism through its banaction. The email portion is what turns a burst of bans into a burst of messages. You can keep the firewall action and remove the mail additions on a jail-by-jail basis.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
There is no authoritative published statistic that defines how many messages constitute a Fail2Ban flood. The useful published figures are configuration examples in the project’s sample jail.conf: bantime = 10m, findtime = 10m, and maxretry = 5. They are examples, not universal recommendations for every service or threat level.
Find which jail and action are responsible
Start with the active-jail list rather than changing global settings blindly. A server may have one noisy SSH jail, several web-authentication jails, or repeated bans from rotating addresses. Each case calls for a different policy.
-
List the jails currently managed by the daemon:
sudo fail2ban-client status -
Inspect an individual jail’s status, including its filter activity, currently banned addresses, and counters:
sudo fail2ban-client status JAIL_NAMEReplace
JAIL_NAMEwith the name shown by the first command, such assshdor your distribution’s web-login jail name. -
Open the effective configuration sources and identify the jail’s
action, mail recipient, and related action parameters. Check the package’sjail.conf, yourjail.local, and every relevant file in/etc/fail2ban/jail.d/. A later local definition can override an earlier one, so reading only one file can give a misleading picture. -
Compare the message timestamps with the jail status counters. If the message count rises whenever the ban count rises, an email action is probably attached to that jail. If several jails are active, isolate the source before tuning thresholds.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Do not assume that the jail name tells you the action. Two jails can protect different services while sharing the same action template, and a distribution can provide a custom jail file that differs from the upstream sample.
Choose whether a jail needs per-ban mail
Use notification value, not fear of missing an attack, as the deciding factor. A ban-only action still blocks the address; it simply does not send the WHOIS or log-line report attached to the mail variants.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
| Jail category | Questions to ask | Reasonable starting policy |
|---|---|---|
| Remote administration, such as SSH | Would an operator investigate each individual source address, or is the pattern already visible in central monitoring? | Keep mail only if each event has high investigative value; otherwise use ban-only and alert on unusual rates. |
| Web authentication | How often do legitimate users mistype credentials, and how many automated probes arrive each hour? | Usually reserve per-ban mail for a carefully selected high-value login surface; tune the threshold to avoid false positives. |
| Mail services | Does one ban correspond to an abuse case that needs immediate review, or are scanners generating routine noise? | Use email for exceptional or high-impact events and a non-email monitoring path for routine blocks. |
When alerts are required, keep email on the highest-value jails and route lower-value events to a rate-limited or digesting monitoring path. A digest preserves visibility without creating one message per address. The exact implementation depends on your monitoring system; Fail2Ban’s action choice determines whether the daemon itself adds the per-ban mail.
Stop mail while keeping bans
Override the noisy jail’s action with the ban-only template in a local jail context:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →[sshd]
action = %(action_)sUse the actual jail name from your installation. The interpolation syntax selects the upstream ban-only action definition while preserving the jail’s configured ban mechanism. If your package uses a custom action or a different variable, retain that installed banaction and remove only the mail-bearing wrapper; do not replace a working firewall action with an arbitrary command.
You can apply the same pattern to a web or mail jail:
[web-auth]
action = %(action_)s
[postfix-sasl]
action = %(action_)sDo not edit the packaged /etc/fail2ban/jail.conf to make this change. The upstream configuration comment says, "You SHOULD NOT modify this file," because package updates may overwrite it. Put the override in one of these locations instead:
/etc/fail2ban/jail.localfor a consolidated local configuration.- A separate file under
/etc/fail2ban/jail.d/when you want one focused override per service or policy.
Use a filename that your distribution loads according to its Fail2Ban configuration order, and keep the section name identical to the enabled jail. If the jail is defined in a vendor-specific file, copy only the settings you intend to override rather than duplicating an entire package configuration.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUnderstand the three controls that determine ban frequency
Fail2Ban’s threshold is defined by three related values:
| Setting | Meaning | Effect of making it stricter | Effect of making it more permissive |
|---|---|---|---|
findtime |
The look-back interval in which failures are counted. | A shorter interval requires failures to arrive quickly, reducing bans from slow, occasional mistakes. | A longer interval allows failures spread over more time to accumulate. |
maxretry |
The number of failures needed during findtime before a ban is triggered. |
A lower number blocks sooner but increases the chance that legitimate mistakes trigger a ban. | A higher number tolerates more failures but can let an attack continue longer. |
bantime |
How long the address remains banned. | A longer ban suppresses repeat attempts and can reduce repeated notifications from the same address, but increases the impact of a mistaken ban. | A shorter ban restores access sooner but can allow an attacker to return and generate more events. |
The Fail2Ban manual accepts seconds and readable abbreviations such as 10m, 1h, and 1d. The project’s configuration definition describes the rule this way: a host is banned if it has generated maxretry during the last findtime seconds. In practical terms, an address that produces five qualifying failures inside a ten-minute window meets the sample rule when maxretry = 5 and findtime = 10m.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
The sample values are:
| Value | Sample setting | What that sample implies |
|---|---|---|
bantime |
10m |
The address is banned for ten minutes unless another policy changes the duration. |
findtime |
10m |
Only failures in the preceding ten minutes count toward the threshold. |
maxretry |
5 |
Five qualifying failures in that interval trigger the ban. |
These values should be treated as a baseline for understanding the mechanism, not as a safe universal profile. A public SSH service with almost no legitimate password use has a different error pattern from a customer login portal, and a mail service may have its own bursts of valid retries.
A safe tuning workflow
-
Measure the current pattern
Record which jails are enabled, how many addresses each jail has banned, and when the messages arrive. Separate a single persistent source from many rotating addresses. A single source may be controlled with a practical ban duration; a rotating population may require threshold or upstream rate controls in addition to Fail2Ban.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Remove unnecessary email first
For a jail that should continue blocking but does not need a report for every address, set
action = %(action_)sin the local jail override. This is the lowest-risk way to stop the flood because it changes notification behavior without changing the filter or the ban decision. -
Keep mail only where a person will act on it
Leave
action_mworaction_mwlon a high-value jail only when the WHOIS report or matching log lines change an operational decision. If every event is routine, a digest or rate-limited monitoring route is more useful than an unbounded mailbox. -
Adjust
maxretryandfindtimefrom real user behaviorReview normal failed-login sequences before changing either value. Lowering
maxretryor lengtheningfindtimecan block attacks earlier, but may ban users who make occasional mistakes. Raisingmaxretryor shorteningfindtimereduces false positives, but delays blocking when an attacker spaces attempts out. -
Set a practical
bantimeLonger bans can reduce repeated attempts and repeated alerts from the same address. They also increase the time a legitimate user remains locked out. Choose a duration that fits the service’s recovery process, and provide an exception for trusted addresses where appropriate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Test at runtime, observe, then persist
Use the runtime controls below to test one change at a time. Watch the jail status, false-positive reports, and mail volume. Once the behavior is acceptable, write the values into
jail.localor a file injail.d; runtime changes alone are lost when the service restarts.
Test settings without editing files first
Fail2Ban exposes runtime commands for the three threshold values. The syntax is:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
sudo fail2ban-client set JAIL_NAME findtime TIME
sudo fail2ban-client set JAIL_NAME maxretry RETRY
sudo fail2ban-client set JAIL_NAME bantime TIMEFor example, to test a fifteen-minute observation window, eight failures, and a one-hour ban on an SSH jail:
sudo fail2ban-client set sshd findtime 15m
sudo fail2ban-client set sshd maxretry 8
sudo fail2ban-client set sshd bantime 1hUse the exact jail identifier reported by fail2ban-client status. Apply changes deliberately rather than pasting a batch into production, because each value changes the behavior of the same active jail.
Free tools Windows power users keep installed
One-click scans. No signup required.
After each change, inspect the jail status again:
sudo fail2ban-client status sshdCheck whether new bans occur at the expected threshold and whether legitimate users can still authenticate. A runtime threshold test does not change the action template; if mail is the problem, the local action override is still required.
Persist the final policy in a local file
A compact local configuration might look like this:
[sshd]
enabled = true
action = %(action_)s
findtime = 15m
maxretry = 8
bantime = 1h
[web-auth]
enabled = true
action = %(action_mwl)s
findtime = 10m
maxretry = 5
bantime = 30mThis example deliberately gives SSH ban-only handling and retains detailed email for a selected web-authentication jail. The names, values, and email choices are policy decisions; copy them only after comparing each service’s normal failure pattern and alert value.
Alternatively, keep service-specific files:
/etc/fail2ban/jail.d/sshd-local.conf
/etc/fail2ban/jail.d/web-auth-alerts.confUse one section per jail in the appropriate file. Keeping overrides separate makes it easier to identify which policy changed when a package update or an operational incident occurs.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use ignoreip to prevent avoidable lockouts
If trusted administration addresses are known, add them to the jail’s ignoreip policy where your installed configuration supports it. This is especially important before making a threshold stricter or a ban longer. Include only addresses you control and maintain the list as networks change; an overly broad exception can create an unprotected path.
Do not use ignoreip as a substitute for understanding a false positive. First determine whether the filter is matching normal application behavior, a health check, a reverse proxy, or a real attack. Then decide whether to correct the filter, adjust the threshold, or exempt a narrowly defined trusted source.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Why longer bans do not solve every flood
A longer bantime can reduce repeat attempts from the same address, but it does not prevent one message for each new address when an email action is attached. Distributed or rotating sources can therefore continue to generate mail even if individual addresses remain banned for a long time. In that situation:
- Use the ban-only action on routine jails.
- Keep per-ban mail on only the highest-value service.
- Send lower-priority events to a rate-limited or digesting monitoring path.
- Review whether the filter is matching a broad class of harmless failures.
- Check whether a proxy, load balancer, or shared gateway is causing many users to appear as one source or causing misleading source addresses.
Fail2Ban’s counters and actions operate on what the jail sees in its logs. If the log source does not preserve the real client address, threshold tuning cannot restore information that is absent from the event.
Common mistakes and recovery steps
| Symptom | Likely cause | Correction |
|---|---|---|
Mail continues after setting action = %(action_)s. |
The override is in the wrong section, the file is not loaded, or another later file replaces the action. | Confirm the exact jail name, inspect all files under /etc/fail2ban/jail.d/, and verify the effective configuration after reloading the daemon. |
| Bans stop along with mail. | The action was replaced with an invalid or non-banning definition rather than the installed ban-only template. | Restore the package’s working banaction and use the upstream action_ wrapper for the no-mail choice. |
| Legitimate users are banned. | maxretry is too low, findtime is too long for the service’s normal retry behavior, or the filter matches valid events. |
Review matched log lines, then raise maxretry, shorten findtime, correct the filter, or add a narrowly scoped trusted address. |
| Attackers return immediately after unbanning. | bantime is too short for the threat pattern, or the attack uses many addresses. |
Choose a longer practical ban for that jail and address rotating-source behavior through alert routing and broader service hardening. |
Changing jail.conf works temporarily, then reverts. |
The package update replaced the vendor file. | Move the change to jail.local or a file in jail.d, as recommended by the upstream configuration comment. |
| Runtime values disappear after a restart. | fail2ban-client set changes are live but not persistent. |
Copy the tested values into the local configuration and reload or restart using your system’s normal service procedure. |
| One incident creates huge messages. | The jail uses action_mwl, which adds matching log lines to every report. |
Use action_mw when WHOIS is enough, or action_ when the ban is sufficient. |
How to compare jails before changing thresholds
Do not apply one global threshold to every service. Compare each jail on four axes:
- Attack surface: public SSH, a customer login page, and a mail-authentication endpoint attract different traffic.
- Normal user error rate: a human-facing login service may legitimately produce several failures in a short period.
- Notification value: decide whether a recipient can take a distinct action for each ban.
- Operational cost: include mailbox load, on-call interruption, investigation time, and the risk of overlooking a genuinely important alert.
A low-error administrative service may justify a lower maxretry and a longer bantime. A busy public login service may need a higher threshold and shorter observation window to avoid punishing normal users. Keep the action choice independent from the threshold choice: removing email does not require weakening the ban, and tightening a threshold does not require enabling email.
Reload and verify without losing control
After writing a local override, use your operating system’s normal Fail2Ban reload or restart procedure, then check the jail again. The exact service-manager command varies by distribution, so use the command already used to manage Fail2Ban on that host. Verification should cover all of the following:
- The jail is enabled and appears in
fail2ban-client status. - The intended
actionis loaded for that jail. - The reported
findtime,maxretry, andbantimematch the values you tested. - Existing bans remain consistent with your operational expectations.
- A test event, if you can generate one safely, produces a ban without an unwanted email.
- High-value jails still deliver the email detail you deliberately retained.
- Your trusted administration addresses remain reachable.
Keep a record of the reason for each jail’s policy. When an alert volume changes, that record lets you distinguish a real traffic change from a configuration change and prevents a future administrator from restoring an email action simply because it was present in the vendor sample.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThe practical decision
Thousands of Fail2Ban emails are usually a notification-policy problem, not a reason to disable protection. Identify the jail producing the messages, choose between action_, action_mw, and action_mwl according to the value of each report, and keep routine bans on the ban-only action. Then tune findtime, maxretry, and bantime against the service’s real failure pattern, test with fail2ban-client, and persist the result outside the package-managed jail.conf.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
