Is there a way to continue to have Fail2Ban send email notification but disable it for an individual service? I keep getting 100 alerts on sshd and I would like to disable email notifications for sshd and everything else to still send email notifications.
In /etc/fail2ban/jail.conf` there’s a section that describes various actions – look for action_, action_mw and action_mwl. You’ll see they vary in scope, from just writing to the logfile to emailing the sysadmin (or even administrators identified in whois lookups) or automatically banning IPs from 3rd-party services like CloudFlare.
Further down is this:
Choose default action. To change, just override value of 'action' with the
interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
globally (section [DEFAULT]) or per specific section action = %(action_)s
In other words, you can have a single definition in /etc/fail2ban/jail.conf and reuse it in jail.local without writing it out again in full. It will need to go in the correct [section] (or “jail”) or under [DEFAULT].
Remember to restart the service afterwards!