My fail2ban logs are getting ridiculously huge… like 16Gb ish…
looking at the logs, they are filled with:
2025-01-08 11:42:50,645 fail2ban.actions [539580]: HEAVY Actions: wait for pending tickets 2 (default 2)
2025-01-08 11:42:50,706 fail2ban.actions [539580]: HEAVY Actions: check-unban 20, bancnt 0, max: 20
Can someone help, if you have any idea what is going on?
You are getting probed it is what is happening. rsyslog should be rotating the log file every few days so you may want to look at that.
Also, if IPTables is not being used, remove the current firewall and put IPTables on. Then install APIBAN
Assuming your fail2ban is actually banning these IPs, try increase the bantime to something like 604800 seconds. Try set your logs to rotate every day instead of every week or after 50MB. Installing VoIP Blacklist may also help.