Re: [Fail2ban-users] fail2ban quickly killing SSDs

[Dominic R. <do...@ti...>]

On 18 July 2017 at 16:00, Patrick Shanahan <pa...@op...> wrote:

> * Robert Kudyba <rk...@fo...> [07-18-17 09:46]:
> >
> > > On Jul 17, 2017, at 11:13 AM, Patrick Shanahan <pa...@op...>
> wrote:
> > >
> > > * Robert Kudyba <rk...@fo... <mailto:rk...@fo...>>
> [07-17-17 10:36]:
> > >>> On Sun, Jul 16, 2017 at 9:37 AM, Jafa <ja...@si...> wrote:
> > >>>
> > >>>> I noticed the SSD lifespan numbers dropping rapidly on some servers
> -
> > >>>> losing a percent every 1-2 days. The wear leveling count was
> incrementing
> > >>>> about once an hour.
> > >>>> Figure 125 days for a new SSD to reach 0% lifespan remaining.
> > >>>>
> > >>>> fail2ban was using a sqlite DB... 130k in size.
> > >>>> Changing the configuration to :memory: fixed the problem - writes
> all but
> > >>>> disappeared.
> > >>>>
> > >>>> Looking at sqlite...
> > >>>> 1) The sqlite DB is causing high disk writes - ~600kB/s to disk
> with a
> > >>>> 130k DB file.
> > >>>> 2) The sqlite DB appears to be writing very small chunks of data
> resulting
> > >>>> in a high write amplification factor.
> > >>>> 3) The sqlite DB appears to be forcing a sync to disk at a high
> rate.
> > >>>> Rewriting part or all of a 130k file should be cached and result in
> very
> > >>>> little write load.
> > >>>>
> > >>>> I suspect configuring sqlite not to force a sync to disk, or to
> force the
> > >>>> sync at a slower rate, say once every 5 seconds, would solve the
> problem.
> > >>>>
> > >>>
> > >>> Answering my own question - it looks like this problem was fixed in
> > >>> fail2ban 0.10 which sets "PRAGMA synchronous=OFF”.
> > >>
> > >> So there’s no way to do this in the 0.95 version?
> > >
> > > you must pay attention to the key word:
> > >
> > >  it looks like this problem was fixed in
> > >                                 ^^^^^
> > >  fail2ban 0.10 which sets "PRAGMA synchronous=OFF”
> > >
> > > wouldn't *that* lead you to believe that there is indeed no way to do
> it
> > > in the 0.95 version?
> >
> > I figured I would ask as there is still some development being done on
> 0.95.
>
> what would that be aside from distros doing backports?
>
> from https://www.fail2ban.org/wiki/index.php/Downloads
>   0.9.x line is no longer heavily developed.  If you are interested in
>   new features (e.g. IPv6 support), please consider 0.10 branch and its
>   releases.
>
> > But why is 0.10 still called alpha?
>
> it has not been released.
>
> version I have is 0.97 which also sets "PRAGMA synchronous = OFF"
> so it must have been fixed earlier than that or openSUSE has backported
> the fix.
>
> ps:  google is you friend and will answer most of your questions
> immediately.
>

​fail2ban 0.9.3 is the latest version supported in Ubuntu 16.04 and it does
not seem to have this setting. Does anyone have a way to install an updated
version (especially 0.10+) successfully with Ubuntu 16.04? I tried and
failed earlier so I am still running 0.9.3, which it does seem is causing
more activity than anything else on my SSD.​