fail2ban — alert on a ban spike (attack in progress)

#!/usr/bin/env bash
# /etc/cron.d/fail2ban-spike
# */5 * * * * root /opt/fail2ban-spike.sh

LOG=${LOG:-/var/log/fail2ban.log}
WINDOW=300                            # last 5 min
THRESH=${THRESH:-20}                  # alert above 20 bans / window
SINCE=$(date -d "-${WINDOW} seconds" '+%Y-%m-%d %H:%M:%S')

COUNT=$(awk -v since="$SINCE" '
  $0 >= since && /Ban / { c++ }
  END { print c+0 }
' "$LOG")

if [ "$COUNT" -gt "$THRESH" ]; then
  curl -fsS "$HEARTBEAT_URL" --data "bans=$COUNT,window=${WINDOW}s"
  exit 2
fi
echo "OK ($COUNT bans / 5m)"