Multiple Fail2ban.sqlite3 Files Consuming Too Much Disk Space

I have recently upgraded my Digital Ocean droplet from 18.04 to 20.04 LTS. After the upgrade, I realized that droplet was consuming 80% of disk space.

I have a basic droplet with 1GB RAM, 1 CPU, 25 GB hard disk to host multiple site and it is a good enough configuration for my need. But high disk space usage may cause some issues later so I wanted to fix this problem.

I had cleaned up all packages and removed old kernels but still the disk usage did not reduce.

Then I tried to find the big files and found couple of files in /var/lib/fail2ban. Each files were approximately 1GB size. Each file had a recent date and time stamp from the day on which I upgraded server. As soon as I rebooted server, it created another 1GB file consuming more hard disk space.

Note: I have no experience in Linux administration. These findings are based on my quick online search.

Root Cause

This is the first time I faced this issue and I was not sure why fail2ban.sqlite3 would grow in GBs. Online search could not provide any explanation. Fail2ban config showed that it purges old data within 24 hours so there was no problem with configuration as well.

There is one speculation that fail2ban.sqlite3 grew in size when it tried to upgrade to the latest version.


At this moment, I did not care of fail2ban.sqlite3 data so I stopped fail2ban service, deleted all the files and restarted the service.

Upon restart, it created a small fail2ban.sqlite3 file and I am back to my normal disk usage.



One response to “Multiple Fail2ban.sqlite3 Files Consuming Too Much Disk Space”

  1. Tarek Jellali Avatar
    Tarek Jellali

    Excellent article and straight to the point! I found out that my Virtual Private Server was at 89% of disk usage and didn’t understand why. Using ncdu I found out it was the /var/lib/fail2ban folder was taking 8+ GB of space.
    I did like you, delete the files and start the service back, no issues whatsoever.

Leave a Reply

Your email address will not be published. Required fields are marked *