'What does "Restore Ban" means in Fail2Ban logs?
Here's output from command sudo zgrep 'Ban' /var/log/fail2ban.log*
2021-11-02 17:11:14,167 fail2ban.actions [30809]: NOTICE [sshd] Ban 38.91.102.38
2021-11-02 17:12:27,085 fail2ban.actions [31041]: NOTICE [sshd] Restore Ban 38.91.102.38
What does "Restore Ban" means?
Solution 1:[1]
It means fail2ban is banning that IP after the service is started/restarted, and that ip was banned before, so fail2ban is restoring the state of 'ban' for that IP.
For example:
- At 1pm, IP 1.2.3.4 is banned for 1 day
- A few minutes later, the fail2ban service is shutdown due to a server reboot.
- When fail2ban starts again, it goes through the database and it bans 1.2.3.4 again.
Therefore the ban is restored.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | user65535 |