Resource Usage

autoban can use a significant amount of memory on the host you run it on. The more traffic you have and the more data you configure autoban to look at, the more it will use (possibly hundreds or thousands of MB).

It can max out a cpu core as well, but this can be overcome by using nice.

To diagnose the resources usage, you can use time -l autoban.pl on OS X or time -v autoban.pl on linux.

Lastly, depending on your ES cluster and how much data you are analyzing, this can put a high load on your ES cluster (or maybe crash it...).