# fail2ban-client commands

> Every fail2ban-client command with syntax, options and real output: status, ban, unban, reload, get and set at runtime, plus the complete command list.
>
> Source: https://fail2ban.dev/commands/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

`fail2ban-client` sends commands to the running fail2ban server over its Unix socket. The syntax is `fail2ban-client [OPTIONS] <COMMAND>`, and it needs root. The most used commands are `sudo fail2ban-client status` (list jails), `status <jail>` (failures and bans), `set <jail> unbanip <IP>`, `set <jail> banip <IP>` and `reload`. Run `fail2ban-client -h` to print every command your installed version supports.

```bash
sudo fail2ban-client status sshd                  # one jail: failures, bans, banned IPs
sudo fail2ban-client set sshd banip 203.0.113.42  # ban an IP
sudo fail2ban-client set sshd unbanip 203.0.113.42
sudo fail2ban-client reload                       # re-read configuration
```

```text
```

- **Server and jail control:** `start`, `stop`, `restart`, `reload`, `status`, `ping`.
- **`get`** reads a setting: `get loglevel` (server-wide) or `get <jail> bantime` (per jail).
- **`set`** changes a setting at runtime: `set loglevel DEBUG` or `set <jail> maxretry 3`.

Runtime `set` changes take effect immediately but are **not saved**. The next `reload` or restart applies whatever is in your configuration files again, so put permanent changes in `/etc/fail2ban/jail.local` — see the [jail.local example](/config/jail-local/).

The jail name is the section name in your configuration (`[sshd]`, `[nginx-http-auth]`, `[recidive]`), not the filter file name. If you mistype it, the client tells you:

```text
$ sudo fail2ban-client status sshdx
... ERROR   NOK: ('sshdx',)
Sorry but the jail 'sshdx' does not exist
```

Options go **before** the command. These are the ones from `fail2ban-client -h` in 1.1.1:

| Option | What it does |
|---|---|
| `-c, --conf <DIR>` | Use another configuration directory (default `/etc/fail2ban`) |
| `-s, --socket <FILE>` | Socket path (default `/var/run/fail2ban/fail2ban.sock`) |
| `-p, --pidfile <FILE>` | PID file path |
| `-d` | Dump the parsed configuration and exit — useful for debugging |
| `--dp, --dump-pretty` | Same as `-d`, more readable |
| `-t, --test` | Test the configuration and exit |
| `-i` | Interactive mode (a `fail2ban>` prompt) |
| `-v` / `-q` | Increase / decrease verbosity (repeatable: `-vvv`) |
| `-x` | Force start: remove a stale socket file first |
| `-b` / `-f` | Start the server in background (default) / foreground |
| `--loglevel <LEVEL>`, `--logtarget <TARGET>` | Override logging when starting the server |
| `--str2sec <STRING>` | Convert a time abbreviation to seconds and exit |
| `-h, --help` | Print options and all commands |
| `-V, --version` | Print the version (`-V` prints a short machine-readable form) |

A few of these are worth knowing by heart:

```text
$ sudo fail2ban-client --version
Fail2Ban v1.1.1
```
# test the configuration without touching the running server
sudo fail2ban-client -t

# show exactly what fail2ban will load for each jail
sudo fail2ban-client -d | grep sshd

# how many seconds is 1d12h?
fail2ban-client --str2sec 1d12h
```

### Interactive mode

`fail2ban-client -i` opens a prompt where you type commands without the `fail2ban-client` prefix. Type `help` for the command list and `exit` or `quit` to leave. It's handy when you run many `get`/`set` commands in a row:

```text
fail2ban> status sshd
fail2ban> get sshd maxretry
fail2ban> exit
```

```text
$ sudo fail2ban-client status
Status
|- Number of jail:	2
`- Jail list:	recidive, sshd
```
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42
```

| Command | Output |
|---|---|
| `status` | Number of jails and their names |
| `status <jail>` | Failures, bans and banned IPs for one jail |
| `status <jail> short` | Same, without the banned IP list |
| `status --all` | Server status plus every jail (1.1.0+) |
| `stats` | One table: backend, failed and banned counts per jail (1.1.0+) |
| `ping` | `Server replied: pong` if the server is alive |

## Ban and unban commands

```text
$ sudo fail2ban-client set sshd banip 192.0.2.15 192.0.2.16
2
$ sudo fail2ban-client set sshd unbanip 192.0.2.15
1
$ sudo fail2ban-client unban 192.0.2.16
1
```

To see what is banned:

```text
$ sudo fail2ban-client banned
[{'sshd': ['203.0.113.42']}, {'recidive': []}]
$ sudo fail2ban-client banned 203.0.113.42
[['sshd']]
$ sudo fail2ban-client get sshd banip --with-time
203.0.113.42 	2026-10-25 18:36:10 + 3600 = 2026-10-25 19:36:10
```

## fail2ban-client get: read jail settings

`get <jail> <option>` shows the value the running jail actually uses — after `jail.conf`, `jail.d/` and `jail.local` have been merged. That makes it the quickest way to check whether your override took effect.

```text
$ sudo fail2ban-client get sshd bantime
3600
$ sudo fail2ban-client get sshd findtime
600
$ sudo fail2ban-client get sshd maxretry
3
$ sudo fail2ban-client get sshd logpath
Current monitored log file(s):
`- /var/log/auth.log
$ sudo fail2ban-client get sshd actions
The jail sshd has the following actions:
nftables
```

## fail2ban-client set: change settings at runtime

```text
$ sudo fail2ban-client set sshd bantime 86400
86400
$ sudo fail2ban-client set sshd addignoreip 192.168.1.0/24
These IP addresses/networks are ignored:
|- 127.0.0.0/8
|- 192.168.1.0/24
`- ::1
```

```bash
sudo fail2ban-client set sshd findtime 1h
sudo fail2ban-client set sshd delignoreip 192.168.1.0/24
sudo fail2ban-client set loglevel DEBUG
sudo fail2ban-client set sshd idle on      # pause the jail without stopping it
```

## Start, stop, restart and reload

| Command | Effect |
|---|---|
| `start` | Start the server and all enabled jails (`Server ready`) |
| `stop` | Stop all jails and the server (`Shutdown successful`) |
| `restart` | Stop and start the server |
| `reload` | Re-read config; keep the server and existing bans (`OK`) |
| `reload <jail>` | Reload one jail |
| `restart <jail>` | Fully restart one jail (alias for `reload --restart <jail>`) |
| `restart --unban <jail>` | Restart one jail and drop its bans |
| `start <jail>` / `stop <jail>` | Start or stop (remove) a single jail |

On systemd hosts, use `sudo systemctl restart fail2ban` for the service and `fail2ban-client reload` for config changes. Which one you need for which change is covered in [restart vs reload](/reload/).

## Logging and database commands

```text
$ sudo fail2ban-client get loglevel
Current logging level is 'INFO'
$ sudo fail2ban-client get logtarget
Current logging target is:
`- /var/log/fail2ban.log
$ sudo fail2ban-client get dbpurgeage
Current database purge age is:
`- 86400seconds
```

## When fail2ban-client can't reach the server

```text
$ sudo fail2ban-client status
2026-10-25 18:36:27,357 fail2ban                [2083]: ERROR   Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?
```

## Complete fail2ban-client command list

All 96 commands from the fail2ban 1.1.1 protocol, grouped as `fail2ban-client -h` prints them. `<JAIL>`, `<IP>` and similar are placeholders. The [command builder](/tools/command-builder/) fills them in for you.



## FAQ

### How do I list all jails in fail2ban?

Run `sudo fail2ban-client status`. It prints the number of jails and a comma-separated `Jail list`. For the details of every jail in one go, use `sudo fail2ban-client status --all` (fail2ban 1.1.0 and later), or loop over the names with `status <jail>` on older versions.

### Why does fail2ban-client say "command not found"?

fail2ban isn't installed, or you're using an account whose `PATH` lacks `/usr/bin` (or `/usr/local/bin` for a source install). Install the `fail2ban` package for your distribution, then run the client with `sudo`. In Docker, run it inside the container with `docker exec <container> fail2ban-client status`.

### Are changes made with fail2ban-client set permanent?

No. `set` changes only the running server. A `reload`, a restart of the service or a reboot reapplies the configuration files. To keep a change, put it in `/etc/fail2ban/jail.local` (or a file in `jail.d/`) and run `sudo fail2ban-client reload`.

### How do I see all fail2ban-client commands for my version?

Run `fail2ban-client -h`. It prints the options and every command the installed version supports, with a one-line description. `man fail2ban-client` shows the same list. Older versions such as 1.0.2 lack `status --all` and `stats`, which arrived in 1.1.0.