See who's attacking your server in Grafana — fail2ban metrics with Prometheus

Airat — Sat, 03 Oct 2026 14:45:12 +0000

Most people set up fail2ban and forget about it. It's running, it's banning IPs, but you have no
idea what's actually happening unless you SSH in and check the logs manually.

This post shows how to add fail2ban metrics to your Prometheus stack and visualize them in Grafana
— so you see ban activity on the same dashboard as CPU, memory, and disk.

## What you'll see

Active bans per jail in real time
Total banned IPs over time
Which jails are firing most — SSH? Nginx? Recidive?
Ban spikes correlated with traffic and load

## Step 1 — Add the exporter

fail2ban doesn't expose Prometheus metrics natively. Add
fail2ban-exporter to your
docker-compose.yml:


yaml
  fail2ban-exporter:
    image: braedon/prometheus-fail2ban-exporter:latest
    volumes:
      - /var/run/fail2ban/fail2ban.sock:/var/run/fail2ban/fail2ban.sock:ro
    ports:
      - "9191:9191"
    restart: unless-stopped

  The exporter reads fail2ban's Unix socket and exposes /metrics on port 9191.

  Step 2 — Add a scrape job to Prometheus

  In prometheus.yml:

  - job_name: 'fail2ban'
    static_configs:
      - targets: ['fail2ban-exporter:9191']

  Restart Prometheus. You should now see metrics like fail2ban_banned_ips and fail2ban_enabled_jails
   in the Prometheus UI.

  Step 3 — Add an alert rule

  The useful one — fires when more than 10 IPs get banned in 5 minutes on any jail:

  - alert: Fail2BanHighBanRate
    expr: increase(fail2ban_banned_ips_total[5m]) > 10
    for: 0m
    annotations:
      summary: "High ban rate — jail {{ $labels.jail }}"

  This catches coordinated brute-force attempts before they become a problem.

  Step 4 — Import the Grafana dashboard

  Download the fail2ban dashboard JSON from the monitoring-stack repo (grafana-dashboards/json/) and
   import it in Grafana via Dashboards → Import.

  The full repo also includes a one-command Ansible deployment for the entire stack — Prometheus,
  Grafana, Alertmanager, Node Exporter, Blackbox Exporter — if you want to set everything up at once
   rather than piece by piece.

  Why bother?

  The first time I saw a ban spike in Grafana — 40 IPs banned in under 2 minutes at 3am — I realized
   I had zero visibility into this before. It was happening, I just couldn't see it.

  Correlating ban events with CPU and network in one view makes it obvious when something is
  actually an attack versus a misconfigured client.

  ---
  Repo: github.com/Airat71/monitoring-stack

DEV Community: Airat

See who's attacking your server in Grafana — fail2ban metrics with Prometheus