Fail2ban performance considerations regarding log size, complexity, and settings

Question

I am new to fail2ban and have difficulty figuring out performance considerations for the different configurations that I'm thinking of. This works on a raspberry pi panel, so performance is a concern.

The obvious optimizations I can think of are the use of efficient regular expressions and only the minimum number of boxes required. I think my specific questions are:

• How does resource utilization increase with respect to search time values? I assume that very small and very large values ​​can affect the server differently with respect to RAM and processor.
• In the same way, how does the size of the log file and the number of different log files controlled by fail2ban affect the total use of resources?

As an example, this jail would allow someone to try 3,600 SSH login passwords per day if they figured out the fail2ban configuration and adjusted the script time for hosting.

[ssh] enabled = true action = iptables-allports[name=ssh] filter = sshd logpath = /var/log/auth.log maxretry = 6 findtime = 120 

If we changed findtime to the other extreme 86400 (1 day), this would only allow 5 attempts per day, but now it controls most of the log file. How does this affect resource utilization?

Another example: a prison for POST attacks:

 [apache-post-flood] enabled = true action = iptables-allports[name=apache-post-flood] filter = apache-post-flood logpath = /var/log/apache2/*access.log maxretry = 10 findtime = 10 

Here we have the opposite, where the search time counter is reset every 10 seconds. It also controls all access logs (I guess, again, I'm new to this). This may mean monitoring access.log, other_vhosts_access.log, and possibly https_access.log for https parts of the site. What if it was a busy day, and these files are all 10-20mb each?

Hope this helps explain what's on your mind. Thanks in advance for your help.

Answer 1

There is only one way to find out, to check it, nothing else.

Add monitoring of memory usage, if necessary, but there is no formula that tells you the amount of CPU, IO or memory that you will need.

As a rule, when setting up your system, add a comment to the new value and date when you need to reconfigure it. This will let you see if there is any trend.

My personal approach is to increase the affected resource from 30-50% each time. If you use less than this, you risk doing it too often.