There is a
dbpurgeage parameter in
fail2ban.conf, which tells how many days of data to keep in the database. The default is one day (
1d), so try do decrease it to a couple of hours:
dbpurgeage = 8h
This setting is coupled with
findtime: it makes no sense to have a
findtime longer than
Edit (2021): The note below was true at the time of writing. However nowadays check out neingeist answer instead: fail2ban 0.11.x which starts being available in Linux distributions (e.g. Debian testing, Ubuntu 20.04 and later, Fedora 33), respects the
Obsolete note: By looking at my own fail2ban database, the
dbpurgeage setting does not seem to be working. Therefore the only solution is to delete the entries manually. For example, in order to delete last year's entries run:
sqlite3 /var/lib/fail2ban/fail2ban.sqlite3 \
"DELETE FROM bans WHERE DATE(timeofban, 'unixepoch') < '2020-01-01'; VACUUM;"
(the sqlite3 executable is usually in the homonymous package).
There seem to be no way to perform a
VACUUM of the database without
sqlite performing a copy of the database in the same directory. However you can copy the file to another filesystem before performing the operation and than copy back the smaller database.