History of Fail2ban - Testing and Monitoring

<h2>Check jail status</h2>

<pre>
# All jails overview
fail2ban-client status

# Specific jail detail
fail2ban-client status nginx-404
fail2ban-client status nginx-botsearch
fail2ban-client status recidive
</pre>

<h2>Manual ban/unban testing</h2>

<pre>
# Ban a test IP
fail2ban-client set nginx-404 banip 1.2.3.4

# Confirm firewalld has the rule
firewall-cmd --list-rich-rules

# Check email arrived in support@ folder

# Unban test IP
fail2ban-client set nginx-404 unbanip 1.2.3.4

# Confirm rule removed
firewall-cmd --list-rich-rules
</pre>

<h2>Check ban times are correct</h2>

<pre>
fail2ban-client get nginx-404 bantime
fail2ban-client get nginx-botsearch bantime
fail2ban-client get recidive bantime
fail2ban-client get recidive findtime
</pre>

<h2>Live monitoring</h2>

<pre>
# Watch fail2ban log in real time
tail -f /var/log/fail2ban.log

# Current banned IPs across all jails
fail2ban-client status nginx-404 | grep &amp;quot;Banned IP&amp;quot;
fail2ban-client status nginx-botsearch | grep &amp;quot;Banned IP&amp;quot;
fail2ban-client status recidive | grep &amp;quot;Banned IP&amp;quot;

# Count total bans
fail2ban-client status nginx-404 | grep &amp;quot;Total banned&amp;quot;
</pre>

<h2>Check firewalld rules</h2>

<pre>
# All current rich rules (fail2ban entries)
firewall-cmd --list-rich-rules

# Count active bans
firewall-cmd --list-rich-rules | wc -l

# Check specific IP is blocked
firewall-cmd --list-rich-rules | grep 1.2.3.4
</pre>

<h2>Recidive specific</h2>

<pre>
# Recidive watches fail2ban.log for repeat offenders
# Ban pattern: banned 3+ times in 24 hours = 1 week ban
# Test by checking known repeat offender
fail2ban-client status recidive

# Recidive restores bans after restart - no email on restore
# Only emails on NEW bans
# To force a new ban notification:
fail2ban-client set recidive unbanip 216.244.66.243
fail2ban-client set recidive banip 216.244.66.243
</pre>

<h2>Regex testing</h2>

<pre>
# Test a filter against actual log
fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/nginx-404.conf | tail -5

# Test recidive filter
fail2ban-regex /var/log/fail2ban.log /etc/fail2ban/filter.d/recidive.conf | tail -5
</pre>

<h2>Troubleshooting</h2>

<pre>
# fail2ban not banning despite log entries
# &amp;rarr; Check filter regex matches log format
fail2ban-regex /var/log/nginx/access.log /etc/fail2ban/filter.d/nginx-404.conf

# Bans not blocking traffic
# &amp;rarr; Check banaction is firewallcmd not iptables
grep banaction /etc/fail2ban/jail.conf
# &amp;rarr; Verify firewalld rules being created
firewall-cmd --list-rich-rules

# No emails from recidive
# &amp;rarr; Recidive restores bans silently on restart
# &amp;rarr; Only new bans trigger email
# &amp;rarr; Test with manual banip

# jail.local overrides not working
# &amp;rarr; Edit jail.conf directly, copy to webstack

# Time suffixes (1w, 1d) supported from fail2ban 0.11+
# &amp;rarr; Verify: fail2ban-client version
</pre>

<h2>Status check script</h2>

<pre>
#!/bin/bash
# /etc/webstack/scripts/fail2ban-status.sh
echo &amp;quot;=== Fail2ban Status ===&amp;quot;
fail2ban-client status

echo &amp;quot;&amp;quot;
echo &amp;quot;=== Active Bans ===&amp;quot;
for jail in nginx-404 nginx-botsearch recidive; do
echo &amp;quot;--- $jail ---&amp;quot;
fail2ban-client status $jail | grep -E &amp;quot;Currently banned|Total banned|Banned IP&amp;quot;
done

echo &amp;quot;&amp;quot;
echo &amp;quot;=== Firewalld Rules ===&amp;quot;
echo &amp;quot;Total rules: $(firewall-cmd --list-rich-rules | wc -l)&amp;quot;
firewall-cmd --list-rich-rules | tail -5
echo &amp;quot;(showing last 5)&amp;quot;
</pre>

<p><em>Developed with [Claude AI](https://claude.ai) assistance - Anthropic - May 2026</em></p>