Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Searching the internet with search engines on MySQL and fail2ban yields lots of results on putting your fail2ban logs into MySQL, however I'm wanting to monitor failed MySQL attempts to log in and ban those IP's.

My application requires that I keep a port for MySQL open, though I have changed the default port for added security. For extra security though, I would like to monitor the MySQL logs with fail2ban.

Does anyone have a quick guide to configuring fail2ban for MySQL? I have it already installed and working on a couple of other services, so you can skip the installation part and jump right to configuring the config file or whatever else is necessary.

share|improve this question

According to this guy (,205612,205612 ) What you are trying to do is not possible.

Also: «the use of mysql.log is described as a performance killer and I heard that it should be obsoleted in next Mysql versions. »

I was looking for the same thing. It is suggested that you block the 3306 port on your firewall. If it's not an option, then, good luck.

share|improve this answer

You could enable mysql logging:

log = /var/log/mysql/access.log
log_error = /var/log/mysql/error.log
log_warnings = 2

so that communication errors would show up in the log and then monitor that file with fail2ban.

share|improve this answer
Important detail: if you're using MySQL 5.6 or above, you must use Fail2ban 0.9.4 or above. At the moment, it is in the EPEL testing repo: yum install fail2ban --enablerepo=epel-testing – maliayas Jun 21 at 21:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.