Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We all know that in fail2ban after reading one log file it will wait for 1 second.the problem is that during that waiting time the attacker make lots of attack. so how can we remove this waiting time?or any other alternative of fail2ban ,that will provide this much facility than fail2ban.

share|improve this question

I don't know if it is wise to remove the waiting period. This will put more stress on your system.

If you want an alternative have a look at OSSEC. On my blog (link in my profile) you can find a post on what it does and how it works. It's very tweakable.

share|improve this answer
Is OSSEC work better or same as fail2ban?because i dont know about OSSEC but fail2ban work very nice that is know. – jagruti Mar 15 '12 at 11:07
I explain it here quite extensive :… It has more options than fail2ban. I prefer it over fail2ban because I can use it distributed over multiple machines. If one machine detects an intrusion attempt, all the other hosts are notified about this. – Lucas Kauffman Mar 15 '12 at 11:19
i have install the OSSEC as per steps given in documentation.but confution is that in that server,local and agent 3 are given so all 3 are install or specific any – jagruti Mar 20 '12 at 10:32
i have install all 3 but there is no any agent in active state shown me.and how can i know wether it is work perfectly now. – jagruti Mar 20 '12 at 10:33
You install 1 server and the rest are agents... – Lucas Kauffman Mar 20 '12 at 11:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.