Fail2ban Ban Report Shell Script for Linux (Daily Summary)

#!/usr/bin/env bash
set -euo pipefail

ALERT_EMAIL="[email protected]"
AUTH_LOG="/var/log/auth.log"
LOG="/var/log/fail2ban-report.log"

log(){ echo "[$(date '+%F %T')] $*" | tee -a "$LOG"; }

REPORT="Fail2ban report for $(hostname -s) — $(date)\n\n"

for jail in $(fail2ban-client status 2>/dev/null | grep 'Jail list' | sed 's/.*://;s/,/ /g'); do
  jail=$(echo "$jail" | xargs)
  [[ -z "$jail" ]] && continue
  status=$(fail2ban-client status "$jail" 2>/dev/null || true)
  banned=$(echo "$status" | grep 'Banned IP list' | sed 's/.*://' | xargs)
  count=$(echo "$status" | grep 'Currently banned' | awk '{print $NF}')
  REPORT+="Jail: $jail | Currently banned: $count\n"
  [[ -n "$banned" ]] && REPORT+="  IPs: $banned\n"
  REPORT+="\n"
done

if [[ -f "$AUTH_LOG" ]]; then
  REPORT+="Top failed SSH IPs (last 24h):\n"
  REPORT+=$(grep 'Failed password' "$AUTH_LOG" 2>/dev/null | \
    grep "$(date +%b' '%e)" | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -5)
  REPORT+="\n"
fi

log -e "$REPORT"
[[ -n "$ALERT_EMAIL" ]] && command -v mail >/dev/null && \
  echo -e "$REPORT" | mail -s "Fail2ban daily report: $(hostname -s)" "$ALERT_EMAIL"