[BR]: systemd-journal - Fail2Ban doesn't see all log records that journalctl does about fail2ban HOT 2 CLOSED

fail2ban-regex --print-all-missed --print-all-ignored --print-all-matched --journalmatch='_SYSTEMD_UNIT=nginx.service + _COMM=nginx' systemd-journald nginx-http-auth-journald

Why systemd-journald (with d at end)? As the man-pages and fail2ban-regex --help says, correct would be systemd-journal (without d).

As for no lines by processing with fail2ban-regex, since #2444 by default journalflags is set to SYSTEM_ONLY(4).

See also #2208 (comment) .

No idea where nginx would write it exactly, but you can try it with:

# local-only:
fail2ban-regex systemd-journal[journalflags=1] nginx-http-auth-journald
# runtime-only:
fail2ban-regex systemd-journal[journalflags=2] nginx-http-auth-journald

and then see which lines it would find in journal (and match the filter).
After all set proper journalflags (or journalpath or journalfiles) to backend in jail:

[nginx-http-auth]
backend = systemd[journalflags=1]

from fail2ban.

Why systemd-journald (with d at end)? As the man-pages and fail2ban-regex --help says, correct would be systemd-journal (without d).

Probably copy-paste mistake, sorry. The command ran. But thank you for guidance. I will have a look on it. I suspected that there is some attribute which I am missing but I wasn't able to discover it.

from fail2ban.