iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Thousands of Fail2Ban messages usually mean that one or more enabled jails are using an email-producing action for every ban. The fastest safe fix is to identify the noisy jail, change it to the ban-only action when per-ban mail is unnecessary, and then tune findtime, maxretry, and bantime in a local override. You keep the firewall block while removing the message flood.
Why Fail2Ban can generate an email flood
Fail2Ban watches service logs, counts failures, and bans an address when it reaches a configured threshold. A host is banned if it has generated maxretry failures during the last findtime seconds. Every new ban can invoke the jail’s configured action.
The upstream configuration provides three commonly used action variants. The basic action_ performs the ban. action_mw performs the ban and sends a WHOIS report by email. action_mwl performs the ban, sends WHOIS information, and includes matching log lines. If several jails use an email action, a burst of login attempts can create one message per ban across all of them.
This is not necessarily a mail-server failure. It may be normal behavior for the selected action, amplified by aggressive thresholds, a heavily attacked service, or rotating source addresses that each trigger a separate ban.
#1 Best Overall
First, locate the jail and action producing the messages
Do not change every jail at once. Start by determining whether one jail, several jails, or repeated bans from changing addresses are responsible.
-
List the active jails with
fail2ban-client status. Record the jail names shown in the output.PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Inspect each active jail, for example with
fail2ban-client status sshd, replacingsshdwith the actual jail name. Note its currently banned addresses and failure counters. -
Search the effective configuration files for action and mail settings. For example:
grep -R "^[[:space:]]*action[[:space:]]*=" /etc/fail2ban/jail.local /etc/fail2ban/jail.d 2>/dev/null grep -R "^[[:space:]]*destemail|^[[:space:]]*sender|^[[:space:]]*mta" /etc/fail2ban/jail.local /etc/fail2ban/jail.d 2>/dev/nullAlso inspect the packaged configuration and the jail definitions that are enabled on your system. Include the mail destination in your notes so you can distinguish a single noisy recipient from a system-wide policy.
-
Compare the timestamps and subjects of the messages with the jail names and ban events. A single jail producing a continuous stream needs a different adjustment from several quiet jails that all happen to email during an attack.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Configuration precedence and distribution packaging vary. Treat the files your installation actually loads as authoritative, rather than assuming that a value visible in a sample file is active.
Understand the three action choices
| Action | What it does | Use when |
|---|---|---|
action_ |
Applies the ban without the WHOIS and matching-log email additions. | You need blocking but do not need an email for every ban. |
action_mw |
Applies the ban and sends a WHOIS report. | A per-ban identity or network report is operationally valuable. |
action_mwl |
Applies the ban and sends WHOIS plus relevant matching log lines. | Investigators need context from the triggering log entries for each alert. |
The suffixes describe additional notification content; all three choices retain the blocking behavior. The names are defined by the installed Fail2Ban action configuration, so confirm that the expected variants exist on your distribution before overriding a jail.
Stop email while keeping bans
For a jail that should continue blocking but does not justify a message for every address, set its action to the ban-only variant in a local jail override:
[sshd]
action = %(action_)sReplace sshd with the enabled jail name. In installations that define a different ban action, use the corresponding installed banaction or action reference instead of copying a name that is not present. Keep email actions only on jails where an individual ban requires immediate human attention.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
After saving the override, reload or restart Fail2Ban using the service method provided by your operating system, then verify the jail status and effective behavior. Existing bans are not a substitute for verification: confirm that new failures still produce bans while the unwanted per-ban messages stop.
Put changes in files that updates will not overwrite
Do not edit the packaged jail.conf as your long-term customization. The Fail2Ban project configuration comment says, “You SHOULD NOT modify this file,” and directs administrators to jail.local or separate files under jail.d. Package updates may replace jail.conf, erasing direct edits.
Use one of these locations instead:
-
/etc/fail2ban/jail.localfor a central set of local overrides. -
A clearly named file under
/etc/fail2ban/jail.d/when you want separate policy files for different services or teams.Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Keep the override limited to the settings you intentionally change. That makes it easier to review after a package update and avoids copying an entire vendor configuration that may become stale. Preserve the jail header, indentation, and parameter names expected by your installed version.
Tune the three settings that control ban volume
Changing the action controls whether a ban sends mail. The threshold settings control how often bans happen in the first place. Tune them together, because a stricter threshold can create more false positives and a looser threshold can permit more attempts before blocking.
| Setting | Meaning | Operational effect |
|---|---|---|
findtime |
The look-back interval in which failures are counted. | A shorter interval ignores failures spread over a longer period; a longer interval combines more attempts. |
maxretry |
The number of failures required within findtime. |
A lower value bans sooner; a higher value tolerates more failed attempts. |
bantime |
How long the address remains banned. | A longer period reduces immediate repeat bans and notifications, but can inconvenience legitimate users. |
The manual accepts seconds and abbreviations such as 10m, 1h, and 1d. Upstream’s sample values are bantime = 10m, findtime = 10m, and maxretry = 5. These are examples, not universal recommendations for every service or traffic pattern.
Choose a threshold from normal user behavior
Begin by examining legitimate failures for the affected service. SSH users who occasionally mistype a password have a different baseline from a public web login endpoint that receives automated probes. A value that is reasonable for one jail can be disruptive for another.
-
Raise
maxretrywhen normal users regularly reach the current limit before correcting a mistake. -
Shorten
findtimewhen failures are harmlessly spread across long periods but a rapid burst should trigger a ban. -
Lengthen
findtimewhen slow, coordinated attempts should count as one attack pattern rather than escaping detection between short windows. -
Use a practical
bantimethat suppresses immediate repeat activity without creating an unnecessarily long lockout for a legitimate address.What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Do not increase every threshold simply to make the mailbox quiet. That can delay blocking and leave a service exposed. Conversely, lowering all thresholds can turn ordinary typing errors, stale credentials, or NAT-shared users into false positives.
Test changes at runtime before making them permanent
Fail2Ban provides runtime controls for a jail. They let you observe the effect without first rewriting a configuration file:
fail2ban-client set <JAIL> findtime <TIME>
fail2ban-client set <JAIL> bantime <TIME>
fail2ban-client set <JAIL> maxretry <RETRY>Replace <JAIL> with the actual jail name, use values such as 10m or 1h for time settings, and provide an integer for <RETRY>. Apply only the setting you are testing when possible, so you can attribute a change in ban and mail volume to a specific adjustment.
-
Record the current jail status and a representative period of mail volume.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Change one runtime value or the jail action.
-
Watch the jail status, failure counts, new bans, and recipient mailbox during the next period of normal traffic or an observed attack burst.
-
Check that legitimate administrators can still connect and that genuinely abusive addresses are still banned.
-
Write the accepted values into
jail.localor a file underjail.d. Runtime changes are for testing; they are not a durable configuration record.
Keep email only where it has decision value
Per-ban email is most useful when a human can act on each message. Compare jails by four factors before choosing an action:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →-
Attack surface: SSH, web authentication, and mail services have different exposure and abuse patterns.
-
Normal error rate: services with many legitimate failed logins can produce noisy, low-value alerts.
-
Notification value: ask whether a single ban changes an incident response decision.
-
Operational cost: account for mailbox volume, on-call interruption, storage, and the time required to inspect WHOIS and log details.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
A practical policy is to use action_ for routine, high-volume jails; reserve action_mw for lower-volume events where network ownership information matters; and use action_mwl only when the matching log lines are needed for investigation. This is a policy choice, not a claim that one action is universally safer.
If alerts are required for a lower-value jail, route them through a rate-limited or digesting monitoring path rather than generating an individual message for every ban. The precise mechanism depends on your monitoring stack; the important control is to separate blocking from human notification.
Use trusted-address exclusions carefully
Longer bans and stricter thresholds can affect legitimate users, especially when several people share one public address. Add trusted administrative addresses to ignoreip where appropriate, and review that list whenever an address, VPN endpoint, or office network changes.
Do not place broad, changing address ranges in an exclusion list merely to avoid alerts. An overly generous exclusion can let abusive traffic bypass the jail entirely. Prefer narrowly scoped, controlled addresses and document why each one is trusted.
Recommended Free Tools
Troubleshooting common outcomes
Bans continue but email has stopped
That is the expected result when the jail uses action_. Verify the jail status and confirm that new offending addresses are still added to the ban list. If bans also stopped, check whether the override used an action name that does not exist in your installation or whether a later configuration file replaced it.
Email remains after changing one jail
Another enabled jail may still use action_mw or action_mwl. Re-run the active-jail list and inspect every jail’s effective action. A single attacker can trigger multiple filters when the same address probes several services.
The mailbox is quieter, but legitimate users are blocked
Review the service’s normal failed-login pattern. Increase maxretry, adjust findtime, or add a narrowly defined trusted address to ignoreip only after confirming the source. Do not solve a false positive by disabling protection for an entire network without an access-control reason.
Changing the packaged file worked until an update
Move the custom values to /etc/fail2ban/jail.local or a file in /etc/fail2ban/jail.d/. Keep the override small and recheck it after upgrades, because jail names, action definitions, and distribution defaults can differ by package version.
Longer bans reduce messages but create lockouts
A longer bantime can prevent the same address from repeatedly generating bans, but it also extends the impact of a mistaken ban. Balance notification reduction against recovery time for legitimate users and maintain an administrative path that is protected by a carefully reviewed ignoreip entry or equivalent access control.
A repeatable tuning checklist
-
Run
fail2ban-client statusand identify all active jails. -
Inspect each relevant jail’s action, destination, and current ban and failure counts.
-
Identify whether the flood comes from one jail, multiple jails, or rotating addresses.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Change non-critical notification jails to
action = %(action_)s, using the installed action definition. -
Review
findtime,maxretry, andbantimeagainst real user behavior; do not assume the upstream sample values fit your service. -
Test individual changes with
fail2ban-client setand observe bans, legitimate access, and mail volume. -
Persist the final policy in
jail.localorjail.d, never only in the packagedjail.conf.Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Recheck the effective settings after a package update or a change to enabled jails.
The durable solution is to treat banning and notification as separate controls. Keep Fail2Ban aggressive enough to protect exposed services, but send per-ban email only where the information can change an operational decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
