How does findtime setting in nginx fail2ban work?

Question

One can set findtime in nginx fail2ban jail. This is the amount of time during which a recurring pattern is counted (called maxretry).

My question is, which of the following is true:

A - If findtime of 60 seconds is set, fail2ban will take action after the 60 seconds are over.

B - If findtime of 60 seconds is set, fail2ban will take action even if the 60 seconds aren't over yet, but the 'maxretry` has been reached.

---

I ask for this distinction because I have a jail where I have set:

findtime = 300
maxretry = 5

Does this mean action will only take place once the 300 seconds are up? If so, I'm going to reduce findtime to 5 (or something similar).

Answer 1

It measures how many occurences of what you are telling fail2ban to monitor for, and compares it to maxretry.

If the occurences are higher than maxretry and if they happened all in the same period of findtime, and they are the same event, so same triggering event and same IP, then it will ban.

300 is the sampling time, 5 is the max samples. There must be 5 samples within 300 seconds to ban.