Fail to ban was also working over time, banning and unbanning ip s for ssh and other services all the time so I'm not sure what was going on, maybe the server was being attacked?
I also use monit and munin to monitor the server and services where failing and restarting several times a day.
Anyway, I have disabled ssh port forwarding to the server and since then had no problems what so ever. Mail warning log is all clear, fail to ban has calmed down and monit has reported no problems.
Thanks for your help.
Last edited by Toucan; 25th August 2010 at 00:15.
Reason: because i can't spelllll