Fail2ban Ban History Database (/var/lib/fail2ban/fail2ban.sqlite3)

Bottom Line: It is 100% safe to clear fail2ban.sqlite3. Fail2ban stores historical IP ban records in SQLite format. Wiping the database simply resets ban history.

Why Does Fail2ban Database Exist?

Fail2ban scans log files (/var/log/auth.log) for failed SSH login attempts and updates iptables firewall rules to block brute-force attackers.

• Primary Purpose: Persisting IP ban history and failure counters across service reboots.
• Storage Growth: High-volume SSH brute-force attacks on public servers expand fail2ban.sqlite3 to 500 MB to 5 GB.

What Happens If You Delete Fail2ban Database?

• System Safety: ✅ 100% Safe to Delete. Active iptables firewall blocks remain active.
• Service Restart: Restarting fail2ban automatically recreates a fresh fail2ban.sqlite3 file.
• Reclaimed Storage: Reclaims 500 MB to 5 GB of storage space.

How to Clear Fail2ban Database

# Stop fail2ban, purge database, and restart
sudo systemctl stop fail2ban
sudo rm -f /var/lib/fail2ban/fail2ban.sqlite3
sudo systemctl start fail2ban

Frequently Asked Questions (FAQ)

How do I limit Fail2ban database retention in fail2ban.conf?

Set dbpurgeage = 1d in /etc/fail2ban/fail2ban.conf to purge ban history older than 1 day automatically.