{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1087","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1087/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1087/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1087/events","html_url":"https://github.com/fail2ban/fail2ban/issues/1087","id":92872605,"number":1087,"title":"Enhancement Request: fail2ban seek to end of log files, rather than reading them","user":{"login":"davidfavor","id":87222,"avatar_url":"https://avatars.githubusercontent.com/u/87222?v=3","gravatar_id":"","url":"https://api.github.com/users/davidfavor","html_url":"https://github.com/davidfavor","followers_url":"https://api.github.com/users/davidfavor/followers","following_url":"https://api.github.com/users/davidfavor/following{/other_user}","gists_url":"https://api.github.com/users/davidfavor/gists{/gist_id}","starred_url":"https://api.github.com/users/davidfavor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidfavor/subscriptions","organizations_url":"https://api.github.com/users/davidfavor/orgs","repos_url":"https://api.github.com/users/davidfavor/repos","events_url":"https://api.github.com/users/davidfavor/events{/privacy}","received_events_url":"https://api.github.com/users/davidfavor/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-07-03T13:10:36Z","updated_at":"2015-07-19T13:34:16Z","closed_at":"2015-07-19T13:34:16Z","body":"I'm using - Fail2Ban v0.8.14 - so maybe this has been fixed + I see no mention in changelogs (that I found) or open issues, so defining problem here.\r\n\r\nIn the case of systems which produce large log files every day (multi-gigabyte files), fail2ban can take many minutes to get to end of files.\r\n\r\nThis occurs on servers hosting several high traffic sites.\r\n\r\nWhen fail2ban starts, it must vie for CPU + I/O resource. I've seen situations where fail2ban can run at 100% CPU usage for better part of an hour, then go to low CPU usage.\r\n\r\nMy guess is this CPU usage indicates fail2ban is reading all logs. If I remove all apache logs (for all sites) + restart, fail2ban begins processing new rules instantly, based on fail2ban logs of block/unblock messages.\r\n\r\nIf fail2ban did a seek to the end of log files, rather than reading each record, initial startup time required to begin banning new IPs would be very fast.\r\n\r\nThanks for your consideration of this enhancement request."},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/122661204","html_url":"https://github.com/fail2ban/fail2ban/issues/1087#issuecomment-122661204","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1087","id":122661204,"user":{"login":"sebres","id":3769657,"avatar_url":"https://avatars.githubusercontent.com/u/3769657?v=3","gravatar_id":"","url":"https://api.github.com/users/sebres","html_url":"https://github.com/sebres","followers_url":"https://api.github.com/users/sebres/followers","following_url":"https://api.github.com/users/sebres/following{/other_user}","gists_url":"https://api.github.com/users/sebres/gists{/gist_id}","starred_url":"https://api.github.com/users/sebres/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sebres/subscriptions","organizations_url":"https://api.github.com/users/sebres/orgs","repos_url":"https://api.github.com/users/sebres/repos","events_url":"https://api.github.com/users/sebres/events{/privacy}","received_events_url":"https://api.github.com/users/sebres/received_events","type":"User","site_admin":false},"created_at":"2015-07-19T13:34:16Z","updated_at":"2015-07-19T13:34:16Z","body":"Nice, that it works with 'tail' :)\r\n\r\nAbout the #1116 - I mean, it contains a feature \"seek to time\", so search for a `now - findtime` with \"half-interval-search\" algorithm, what should be very fast. Additionally this branch should be several times faster as original (for example search of failures 2x faster etc.)."}}