The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To monitor Fail2ban in Grafana, expose its jail metrics for Prometheus to scrape, then build Grafana panels from the metric names your chosen collection method actually provides. The most direct option is a dedicated exporter that reads Fail2ban’s server socket. If Node Exporter’s textfile collector is already part of your setup, a script that writes a .prom file may fit better.
Choose how to collect Fail2ban metrics
Prometheus commonly uses exporters to collect metrics from services that do not expose Prometheus metrics themselves. For Fail2ban, choose between a dedicated socket exporter and a script that writes textfile metrics for Node Exporter.
As an Amazon Associate I earn from qualifying purchases.
| Consideration | Dedicated socket exporter | Node Exporter textfile script |
|---|---|---|
| How it collects | Reads the Fail2ban server socket and serves an HTTP metrics endpoint. | Runs fail2ban-client and writes metrics to a .prom file. |
| Best fit | A standalone exporter deployment; the hctrdev project also documents a sample Grafana dashboard. | An existing Node Exporter textfile-collector setup where periodic script execution fits local operations. |
| Main operational dependencies | Socket location and permissions, plus the exporter process or container. | Script schedule, command permissions, output path, and valid Prometheus text format. |
| Example metric names | f2b_jail_banned_current and f2b_jail_failed_total. |
fail2ban_banned_current and fail2ban_failed_total. |
The examples and deployment details below refer to the community projects’ documented approaches; check their current releases, configuration, and compatibility before using them in production. Prometheus notes that some exporters are externally contributed and maintained, and says it cannot vet all third-party exporters for best practices (Prometheus exporters and integrations).
Deploy a dedicated Fail2ban exporter
The hctrdev Fail2ban Prometheus exporter documents both a standalone binary and a container deployment. Its quick start uses /var/run/fail2ban/fail2ban.sock and listens on port 9191. Treat these as documented defaults, not universal values: verify the socket path on your host and use the exporter’s configuration for a different socket or listen address.
#1 Best Overall
Check socket access before troubleshooting the endpoint
The exporter must be able to connect to Fail2ban’s server socket. If the socket is missing from the exporter’s view, check the host path, container mount, and Fail2ban configuration. If it exists but access fails, permissions may be the cause; Fail2ban commonly restricts its socket to its service user, often root.
- Prefer a deliberate service-user arrangement that grants the exporter the access it needs without broadly exposing the socket.
- The exporter project lists running it as the same user as Fail2ban, changing Fail2ban’s configured user, or relaxing socket permissions as possible approaches. It describes the same-user option as the simplest and notes that manual permission changes can be temporary because a Fail2ban restart recreates the socket.
- Do not weaken socket permissions casually. Evaluate the security consequences and keep access limited to the required services.
For Docker, mount the socket’s parent directory
The exporter project recommends mounting /var/run/fail2ban, rather than binding only the socket file. Fail2ban deletes and recreates the socket when it stops and starts, so a mount of the individual file may no longer refer to the active socket after a restart. Its container example uses a read-only directory mount and maps exporter port 9191. Review the image source and select a pinned release tag for reproducible deployments rather than assuming a moving latest tag is stable.
Confirm the metrics endpoint
Once the exporter can reach the socket, query its /metrics endpoint and inspect the series it emits. The project documents exporter health and error metrics, jail count, current and total banned IPs, current and total failures, jail configuration values, and version information. Use the exact names and labels shown by your running endpoint when configuring Prometheus and Grafana.
Configure Prometheus to scrape the exporter
Add the exporter host and port as a scrape target in the Prometheus configuration. The host and port must be reachable from the Prometheus server; use the actual listen address and deployment network rather than assuming that the documented port is accessible everywhere.
After updating the configuration, reload or restart Prometheus using the procedure for your installed version and service manager. There is no single reload command that applies to every Prometheus deployment. Check the target’s status in Prometheus and confirm it is healthy before troubleshooting Grafana queries.
Connect Grafana and create panels
- Add Prometheus as a data source. In Grafana, open Connections > Data sources, add Prometheus, and set the server URL to an address Grafana can reach. Test the connection. The Prometheus data source is documented as preinstalled in Grafana and supports PromQL queries, visualizations, and alerting (Grafana Prometheus data source documentation).
- Check the available series. Use Grafana’s query editor to find the metric names and labels exposed by your installed exporter. Do not assume that a query written for one collection method will work with the other.
- Build panels around operational questions. Start with current banned IPs by jail, then add failures and bans over time, current failures, and exporter or scrape health. Include jail configuration values only when they add useful context.
- Validate the panel against the source. Compare its result with the exporter endpoint and Prometheus target status. This helps distinguish a query or label mismatch from a collection failure.
The hctrdev project includes a sample Grafana dashboard, supports multiple exporters, and documents an instance variable. Its README states compatibility with Grafana 9.1.8 and above; confirm the dashboard’s queries and metric names against your installed Grafana and exporter versions before relying on it.
Rank #4
Use Node Exporter textfile metrics instead
If Node Exporter’s textfile collector is already deployed, the jangrewe Fail2ban exporter script provides an alternative to running a separate HTTP exporter. It uses fail2ban-client to collect current and total failures and bans, then writes metrics to /var/lib/prometheus/node-exporter/fail2ban.prom by default. It can collect all enabled jails or a specified jail and supports a custom output file.
Recommended Free Tools
For this approach, arrange for the script to run periodically with the permissions it needs, and ensure its output is in the location Node Exporter reads. The textfile collector reads .prom files, and the script is responsible for emitting valid Prometheus text format. Monitor both the script’s successful execution and the resulting scrape; a file that is stale or malformed will not provide reliable current data.
Best Value
Choose queries based on metric type and reset behavior
Similar metric names do not guarantee identical semantics. The hctrdev exporter distinguishes current values from totals since Fail2ban startup. The jangrewe example labels its totals as gauges. Verify the type, labels, and reset behavior in the selected exporter before applying PromQL functions or interpreting a trend as a rate.
- Current banned IPs: use the current-value series and group or filter by jail labels that the endpoint actually exposes.
- Failures and bans over time: check whether the series is a counter or gauge before choosing a rate or change calculation.
- Exporter and scrape health: inspect the exporter’s health/error series and Prometheus target status so that missing data is visible rather than mistaken for zero activity.
- Jail settings: configuration metrics such as ban time, find time, and maximum retries can provide context, but include them only if your exporter emits them and they help answer an operational question.
Secure and troubleshoot the monitoring path
Exporter cannot find or open the socket
- Confirm the socket’s actual location on the host and match the exporter’s configured path.
- For a container, check that the host directory containing the socket is mounted into the expected container path.
- Check that the exporter’s service user can access the socket. Prefer a least-privilege user arrangement over broad permission changes.
Prometheus target is down
- Verify that the exporter is running and that its metrics endpoint responds from the Prometheus server’s network.
- Check the scrape target’s host, port, and any network or firewall rules between Prometheus and the exporter.
- If the exporter runs in Docker, confirm the port mapping and that the endpoint is bound to an address reachable by Prometheus.
Grafana shows no data
- Test the Prometheus data source and check that Prometheus has scraped the target successfully.
- Search for the metric name in Prometheus or Grafana before writing a panel query.
- Match the query to the installed exporter’s prefix and labels: the dedicated exporter uses
f2b_names, while the textfile example usesfail2ban_names.
Restrict access to the endpoint
Allow access to the exporter endpoint only from Prometheus or a trusted monitoring network unless you have configured appropriate authentication and access controls. The hctrdev exporter documents optional basic authentication; check its configuration for the current setup details. Review the exporter’s source, maintenance, release process, permissions, and container image provenance before relying on it in production.
Keep Grafana protection separate from metrics export
Fail2ban upstream configuration includes a [grafana] jail example that watches Grafana’s log file (Fail2ban upstream jail configuration). This is an optional way to protect a Grafana service with Fail2ban; it is separate from exporting Fail2ban metrics to Prometheus and is not required for dashboards or monitoring.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
