It’s in French but it’s not so much complicated to understand with some translate’s help.
I’ve tryed this solution based on Logwatch report for some IPs.
I’ve changed my ssh’s port for another one more exotic and propagated in fail2ban conf.
It’s quieter now
