fail2ban sqlite database prune

On servers where fail2ban has been working for a long time, you might notice the size of its database eating up your disk space. I just found one that had ballooned to over 2Gb over the course of a year. You'll find it hiding in /var/lib/fail2ban/

ls -hal /var/lib/fail2ban/

If its causing you anguish, then you can easily prune it with the following commands. Obviously you'll need to install sqlite3 first if its not installed.

sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 "delete from bans where timeofban <= strftime('%s', date('now', '-90 days'));"
sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 "vacuum;"

That will delete all entries over 90 days. You may want to put it into a script run by cron, in which case include the path to sqlite eg. /usr/bin/sqlite3

Update Feb 2021

I read a post elsewhere where someone wanted to remove all fail2ban history and start fresh. In that case the magic commands are … with sudo as required.

systemctl stop fail2ban
truncate -s 0 /var/log/fail2ban.log
rm /var/lib/fail2ban/fail2ban.sqlite3
systemctl start fail2ban