# Alarm configuration for fail2ban

**URL:** <https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800>\
**Category:** Help\
**Tags:** agent\
**Created:** [January 20, 2021, 6:24pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800 "2021-01-20T18:24:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![youmakemyday](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/youmakemyday/32/396_2.png) [@youmakemyday](https://community.netdata.cloud/u/youmakemyday)\
**Post date:** [January 20, 2021, 6:24pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800/1 "2021-01-20T18:24:29Z")

</div>

Hello together,

is it possible to notify me, then the “BanCounter” (fail2ban.jails\_in\_jail) count in 5 minutes more then 3 new IPs?

Thx for this great tool and your help.

my test-config looks like that:  
# /usr/lib/netdata/conf.d/health.d/fail2ban.conf  
alarm: fail2ban  
on: fail2ban.jails\_in\_jail  
lookup: average -1m collected\_total\_raw  
every: 60s  
warn: $this \> 2  
delay: down 5m multiplier 1.5 max 1h  
plugin: python.d.plugin  
module: fail2ban  
info: fail2ban more then 2 in 1 minute  
to: sysadmin

---

<div class="post-metadata">

**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\
**Post date:** [January 20, 2021, 7:21pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800/2 "2021-01-20T19:21:40Z")

</div>

Hi @youmakemyday 👋

If you want if **sum of jailed IPs** (sum) more then 3 ($this \> 3) and get notified after it’s been so for 5 minutes (up 5m), try the following:

```yaml
alarm: fail2ban
on: fail2ban.jails_in_jail
lookup: sum -10s
every: 10s
warn: $this > 3
delay: up 5m down 1m multiplier 1.5 max 1h
info: fail2ban more then 3 in 5 minute
to: sysadmin

```

* * *

> and get notified

I mean via email or whatever notification method you are using.

---

<div class="post-metadata">

**Author:** ![youmakemyday](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/youmakemyday/32/396_2.png) [@youmakemyday](https://community.netdata.cloud/u/youmakemyday)\
**Post date:** [January 20, 2021, 9:32pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800/3 "2021-01-20T21:32:56Z")

</div>

Hello Ilyam,  
thx for your answer. My Fail2ban configuration is banning permanently, so the „Ban-Counter“ is growing with any new ban. I want to notify, when fail2ban log more then 3 new Bans in 5 minutes.

Example:  
22:00:00 Total Bans: 55  
22:04:00 Total Bans: 58+ notify me (pushover)

Thx for your help.

---

<div class="post-metadata">

**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\
**Post date:** [January 20, 2021, 9:41pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800/4 "2021-01-20T21:41:51Z")

</div>

Then we need `jails_bans` chart, it contains bans rate - check every 5m minutes last 5 minutes of data. Would that do?

```auto
alarm: fail2ban
on: fail2ban.jails_bans
lookup: sum -5m
every: 5m
warn: $this > 3
delay: down 5m multiplier 1.5 max 1h
info: fail2ban more then 3 in 5 minute
to: sysadmin

```

---

<div class="post-metadata">

**Author:** ![youmakemyday](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/youmakemyday/32/396_2.png) [@youmakemyday](https://community.netdata.cloud/u/youmakemyday)\
**Post date:** [January 20, 2021, 10:30pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800/5 "2021-01-20T22:30:23Z")

</div>

i will try and give you feedback tomorrow. thanks so much.

---

<div class="post-metadata">

**Author:** ![youmakemyday](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/youmakemyday/32/396_2.png) [@youmakemyday](https://community.netdata.cloud/u/youmakemyday)\
**Post date:** [January 21, 2021, 7:46pm UTC](https://community.netdata.cloud/t/alarm-configuration-for-fail2ban/800/6 "2021-01-21T19:46:53Z")

</div>

Hello Ilyam8,

the config looks good, i believe it works. I will test a few days and give then feedback again.

Thanks for your help.