Ubuntu – Too much emails from fail2ban

I figured it out! My setup was correct afterall. Here's what was happening:

Triggers are only set when a state changes, therefore all my triggers were either false OR true and were not changing state as the items I was monitoring were not changing state either.

To successfully test my triggers, I had to do this:

1. Make an item to ping a server every 5 sec (you can just use a default template item but I wanted results fast...)

2. Make an action for my server which gets executed if:

   Trigger severity >= "Warning" AND Host = "My Server"

3. I then created a trigger which gets set if ping = 1 (which it always does...) and volia! I received an email

The problem I was having was that by creating my "test trigger" before my "test alert" the trigger was already getting set before my alert was saved. And so... i had no idea why I wasn't seeing any notifications.

Well, I'm no regex master (or even novice), but I did manage to get it to work by adding:

^.*authentication failure;.*rhost=<HOST>

to filters.d/sshd.conf. This did it and I've successfully banned my first host. If any regex experts would like to chime in, I'd be greatly appreciative. I'm sure there's a case that I'm missing in this short expression that would fail in a certain case.

Thanks!