Commands

fail2ban status: is it running, and what the jail status means

Two commands tell you whether fail2ban is alive and what each jail is doing. This page shows both and explains every line of the jail status output.

Updated 6 min readChecked against fail2ban 1.1.1

To check fail2ban's status, run sudo systemctl status fail2ban to see whether the service is running, then sudo fail2ban-client status to list the active jails and sudo fail2ban-client status sshd for one jail. The jail status shows how many failures the filter found (Currently failed, Total failed), which log it watches, and how many IPs are banned (Currently banned, Total banned) with the Banned IP list.

bash
sudo systemctl status fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd

Is fail2ban running?#

  1. Service state. sudo systemctl status fail2ban should show Active: active (running). For a plain yes/no, systemctl is-active fail2ban prints active.
  2. Server responds. The client talks to the server over a socket; ping proves the whole path works:
output
$ sudo fail2ban-client ping
Server replied: pong
  1. Jails are loaded. sudo fail2ban-client status lists them (next section).

If the server isn't running, every client command fails with:

output
$ sudo fail2ban-client status
2026-10-25 18:36:27,357 fail2ban                [2083]: ERROR   Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?

Start it with sudo systemctl start fail2ban, and enable it at boot with sudo systemctl enable fail2ban. If it won't stay up, see the next section.

fail2ban status 255: the service failed#

When systemctl status fail2ban shows failed with status=255/EXCEPTION, fail2ban stopped because of a configuration error. Exit code 255 tells you that it failed, not why. Find the reason with:

bash
sudo fail2ban-client -t                 # tests the config and prints the error
sudo journalctl -u fail2ban -n 50 --no-pager

The usual causes are a jail whose log file doesn't exist (Have not found any log file for sshd jail), a typo in jail.local, or a missing filter. The fixes are on fail2ban exit code 255 and no log file found for jail.

fail2ban-client status: list jails#

output
$ sudo fail2ban-client status
Status
|- Number of jail:	2
`- Jail list:	recidive, sshd

Number of jail: 0 means the server runs but no jail is enabled. Stock jail.conf enables nothing; distribution packages usually enable sshd in /etc/fail2ban/jail.d/. Enable jails with enabled = true in jail.local and reload — see the jail.local example.

fail2ban-client status sshd explained#

output
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42

The Filter block describes log matching; the Actions block describes bans.

Field Meaning
Currently failed Number of IP addresses that have failures on record within findtime but are not banned yet
Total failed Number of failure lines matched since the jail started
File list Log files the jail monitors (file backends)
Journal matches Journal filter the jail uses (systemd backend; replaces File list)
Currently banned IPs banned right now
Total banned Bans since the jail started, including expired ones and bans restored from the database
Banned IP list The currently banned addresses

The counters live in memory: a restart of fail2ban or of the jail resets Total failed and Total banned.

Currently failed vs Total failed#

Currently failed counts addresses, Total failed counts failures. In the example, 2 IPs are being tracked right now and 6 failed attempts have been matched since start. An IP leaves the "currently failed" list when it gets banned or when its failures age out of findtime.

How to read the pair:

  • Total failed is 0 after real failed logins: the filter isn't matching your log lines, or the jail watches the wrong file or journal. Test with fail2ban-regex.
  • Total failed rises but nothing gets banned: each IP fails fewer than maxretry times within findtime, or the IPs are on ignoreip. See fail2ban not banning.
  • Currently failed stays high: many different IPs are each making a few attempts — normal on an SSH port open to the internet.

Currently banned vs Total banned#

Currently banned is the live count; Total banned keeps growing as bans expire and new ones start. A large Total banned with a small Currently banned simply means bans are short. Use get sshd banip --with-time to see when each one ends, or list banned IPs for more options.

File list vs Journal matches#

With a file backend (auto, pyinotify, polling) the status shows File list. With backend = systemd it shows the journal filter instead:

text
`- Journal matches:	_SYSTEMD_UNIT=sshd.service + _COMM=sshd + _COMM=sshd-session

An empty File list on a jail that should read a file means fail2ban found no file matching logpath. Debian 12 is the classic case: it has no /var/log/auth.log because rsyslog isn't installed. Switch that jail to backend = systemd — details on backends and the systemd journal.

Status of all jails at once#

On fail2ban 1.1.0 and later:

bash
sudo fail2ban-client status --all          # every jail, same format as above
sudo fail2ban-client status --all short    # without the banned IP lists
sudo fail2ban-client stats                 # one compact table

status <jail> accepts the same flavors: short leaves out the IP list, and cymru adds the ASN, country and RIR of banned IPs (it needs the dnspython module). Ubuntu 24.04 and Debian 12 ship 1.0.2, which lacks --all and stats; loop over the jail names instead (example on list banned IPs).

Status from the log#

The jail status is a snapshot. fail2ban's log shows the history — each Found is a failure, each Ban a ban:

log
2026-10-25 18:36:10,238 fail2ban.filter         [1997]: INFO    [sshd] Found 203.0.113.42 - 2026-10-25 18:36:10
2026-10-25 18:36:11,027 fail2ban.actions        [1997]: NOTICE  [sshd] Ban 203.0.113.42
bash
sudo tail -f /var/log/fail2ban.log

See fail2ban logs for log locations and grep recipes.

FAQ#

How do I check if fail2ban is running?#

Run sudo systemctl status fail2ban and look for Active: active (running), then sudo fail2ban-client ping, which answers Server replied: pong when the server is up. If the client reports "Failed to access socket path … Is fail2ban running?", the service is stopped or you forgot sudo.

What is the difference between Currently failed and Total failed?#

Currently failed is the number of IP addresses with recent failures (within findtime) that aren't banned yet. Total failed is the number of failed attempts the filter has matched since the jail started. One IP with five failures adds 1 to the first and 5 to the second.

What does Total banned mean in fail2ban?#

It is the number of bans the jail has issued since it started, including bans that have already expired and bans restored from the database at startup. Currently banned shows only the active ones. Both reset when fail2ban or the jail restarts.

Why does fail2ban status show Number of jail: 0?#

No jail is enabled. Stock jail.conf sets enabled = false for every jail. Add [sshd] with enabled = true to /etc/fail2ban/jail.local, check it with sudo fail2ban-client -t, then run sudo fail2ban-client reload. Distribution packages usually enable sshd in jail.d/.

List banned IPsList banned IPs in fail2ban: status <jail>, banned, get banip --with-time, all jails at once, check one IP, and read bans from nftables, iptables or the database.fail2ban-client commandsEvery fail2ban-client command with syntax, options and real output: status, ban, unban, reload, get and set at runtime, plus the complete command list.Logs and log locationWhere fail2ban logs (/var/log/fail2ban.log or the journal), how to read Found, Ban and Unban lines, change the log level, rotate logs and grep for top banned IPs.Not banning or not blockingfail2ban not working? Find out if the jail fails to ban or bans without blocking, then fix the log source, filter, ignoreip, thresholds, port or firewall.Exit code 255 / service failedfail2ban.service exited with status=255/EXCEPTION? Find the real error with journalctl and fail2ban-client -t, then fix missing logs, config typos or Python 3.12.

Spotted something wrong or out of date? Tell us — every page is checked against the current fail2ban release.