# fail2ban status: is it running, and what the jail status means

> Check fail2ban status with systemctl and fail2ban-client status sshd, and what Currently failed, Total failed, Currently banned and Total banned really mean.
>
> Source: https://fail2ban.dev/status/ · Updated 2026-10-25 · Checked against fail2ban 1.1.1
> fail2ban.dev is an independent guide, not the official fail2ban project.

To check fail2ban's status, run `sudo systemctl status fail2ban` to see whether the service is running, then `sudo fail2ban-client status` to list the active jails and `sudo fail2ban-client status sshd` for one jail. The jail status shows how many failures the filter found (`Currently failed`, `Total failed`), which log it watches, and how many IPs are banned (`Currently banned`, `Total banned`) with the `Banned IP list`.

```bash
sudo fail2ban-client status
sudo fail2ban-client status sshd
```


1. **Service state.** `sudo systemctl status fail2ban` should show `Active: active (running)`. For a plain yes/no, `systemctl is-active fail2ban` prints `active`.
2. **Server responds.** The client talks to the server over a socket; `ping` proves the whole path works:

   ```text output
   $ sudo fail2ban-client ping
   Server replied: pong
   ```

3. **Jails are loaded.** `sudo fail2ban-client status` lists them (next section).

If the server isn't running, every client command fails with:

```text
$ sudo fail2ban-client status
2026-10-25 18:36:27,357 fail2ban                [2083]: ERROR   Failed to access socket path: /var/run/fail2ban/fail2ban.sock. Is fail2ban running?
```

## fail2ban status 255: the service failed

When `systemctl status fail2ban` shows `failed` with `status=255/EXCEPTION`, fail2ban stopped because of a configuration error. Exit code 255 tells you *that* it failed, not *why*. Find the reason with:

```bash
sudo journalctl -u fail2ban -n 50 --no-pager
```

## fail2ban-client status: list jails

```text
$ sudo fail2ban-client status
Status
|- Number of jail:	2
`- Jail list:	recidive, sshd
```

## fail2ban-client status sshd explained

```text
$ sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed:	2
|  |- Total failed:	6
|  `- File list:	/var/log/auth.log
`- Actions
   |- Currently banned:	1
   |- Total banned:	1
   `- Banned IP list:	203.0.113.42
```

| Field | Meaning |
|---|---|
| `Currently failed` | Number of **IP addresses** that have failures on record within `findtime` but are not banned yet |
| `Total failed` | Number of **failure lines** matched since the jail started |
| `File list` | Log files the jail monitors (file backends) |
| `Journal matches` | Journal filter the jail uses (systemd backend; replaces `File list`) |
| `Currently banned` | IPs banned right now |
| `Total banned` | Bans since the jail started, including expired ones and bans restored from the database |
| `Banned IP list` | The currently banned addresses |

The counters live in memory: a restart of fail2ban or of the jail resets `Total failed` and `Total banned`.

### Currently failed vs Total failed

`Currently failed` counts *addresses*, `Total failed` counts *failures*. In the example, 2 IPs are being tracked right now and 6 failed attempts have been matched since start. An IP leaves the "currently failed" list when it gets banned or when its failures age out of `findtime`.

How to read the pair:

- **Total failed is 0** after real failed logins: the filter isn't matching your log lines, or the jail watches the wrong file or journal. Test with [fail2ban-regex](/fail2ban-regex/).
- **Total failed rises but nothing gets banned:** each IP fails fewer than `maxretry` times within `findtime`, or the IPs are on `ignoreip`. See [fail2ban not banning](/troubleshooting/not-banning/).
- **Currently failed stays high:** many different IPs are each making a few attempts — normal on an SSH port open to the internet.

### Currently banned vs Total banned

`Currently banned` is the live count; `Total banned` keeps growing as bans expire and new ones start. A large `Total banned` with a small `Currently banned` simply means bans are short. Use `get sshd banip --with-time` to see when each one ends, or [list banned IPs](/banned-ips/) for more options.

### File list vs Journal matches

With a file backend (`auto`, `pyinotify`, `polling`) the status shows `File list`. With `backend = systemd` it shows the journal filter instead:

```text
```

## Status of all jails at once

On fail2ban 1.1.0 and later:

```bash
sudo fail2ban-client status --all short    # without the banned IP lists
sudo fail2ban-client stats                 # one compact table
```

## Status from the log

The jail status is a snapshot. fail2ban's log shows the history — each `Found` is a failure, each `Ban` a ban:

```log
2026-10-25 18:36:11,027 fail2ban.actions        [1997]: NOTICE  [sshd] Ban 203.0.113.42
```
sudo tail -f /var/log/fail2ban.log
```

## FAQ

### How do I check if fail2ban is running?

Run `sudo systemctl status fail2ban` and look for `Active: active (running)`, then `sudo fail2ban-client ping`, which answers `Server replied: pong` when the server is up. If the client reports "Failed to access socket path … Is fail2ban running?", the service is stopped or you forgot `sudo`.

### What is the difference between Currently failed and Total failed?

`Currently failed` is the number of IP addresses with recent failures (within `findtime`) that aren't banned yet. `Total failed` is the number of failed attempts the filter has matched since the jail started. One IP with five failures adds 1 to the first and 5 to the second.

### What does Total banned mean in fail2ban?

It is the number of bans the jail has issued since it started, including bans that have already expired and bans restored from the database at startup. `Currently banned` shows only the active ones. Both reset when fail2ban or the jail restarts.

### Why does fail2ban status show Number of jail: 0?

No jail is enabled. Stock `jail.conf` sets `enabled = false` for every jail. Add `[sshd]` with `enabled = true` to `/etc/fail2ban/jail.local`, check it with `sudo fail2ban-client -t`, then run `sudo fail2ban-client reload`. Distribution packages usually enable sshd in `jail.d/`.