So… you’re doing it manually. Don’t think I’m going to be doing that. I see that it must be keeping track, but w/o testing against an IP of my own, I probably can’t see for sure. Getting the hang of the logs stuff, and got a couple charts in Grafana now. I’m kinda watching authentication failure counts, as well as when someone has tried to connect at least twice, so that “one more time, young man!” will get them banned. But it seems a LOT of the botnets, whatever, are coming in under the threshold:
The logs are reporting the “1 more attempt” til ban entries… just 2 for all of today. I upped the attempt window, too, to 3600 seconds (1 hour), but still not catching much.
Note: I only started getting better logging here last night when I straightened out the promtail / loki configs.
