{"action":"created","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1341","repository_url":"https://api.github.com/repos/fail2ban/fail2ban","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1341/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1341/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1341/events","html_url":"https://github.com/fail2ban/fail2ban/issues/1341","id":137335907,"number":1341,"title":"sshd jail does not find valid matches in the journal","user":{"login":"goeranu","id":1842587,"avatar_url":"https://avatars.githubusercontent.com/u/1842587?v=3","gravatar_id":"","url":"https://api.github.com/users/goeranu","html_url":"https://github.com/goeranu","followers_url":"https://api.github.com/users/goeranu/followers","following_url":"https://api.github.com/users/goeranu/following{/other_user}","gists_url":"https://api.github.com/users/goeranu/gists{/gist_id}","starred_url":"https://api.github.com/users/goeranu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/goeranu/subscriptions","organizations_url":"https://api.github.com/users/goeranu/orgs","repos_url":"https://api.github.com/users/goeranu/repos","events_url":"https://api.github.com/users/goeranu/events{/privacy}","received_events_url":"https://api.github.com/users/goeranu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2016-02-29T18:45:16Z","updated_at":"2016-03-04T22:06:30Z","closed_at":null,"body":"### Environment:\r\n- Fail2Ban version (including any possible distribution suffixes): 0.9.3-1.fc23\r\n- OS, including release name/version: Fedora 23\r\n- [x] Fail2Ban installed via OS/distribution mechanisms\r\n- [x] You have not applied any additional foreign patches to the codebase\r\n- [x] Some customizations were done to the configuration (provide details below is so)\r\n\r\n### The issue:\r\nFor some reason, the _sshd_ jail isn't finding the matches it ought to find.  I have configured fail2ban to use the systemd backend by default, and it seems to work for example for the _dovecot_ jail, but not for _sshd_.  I've tried to match the strings from `journalctl` commands, and the expressions do match.  But nothing is banned, and no matches show up in `fail2ban.log`.\r\n\r\n#### Steps to reproduce\r\nEnable the _sshd_ jail and wait for attacks.\r\n\r\n#### Expected behavior\r\nMatches listed in `/var/log/fail2ban.log`, and after a few matches from the same host, that host being banned.\r\n\r\n#### Observed behavior\r\nNo obvious action from fail2ban.\r\n\r\n### Configuration, dump and another helpful excerpts\r\nThis is the status of the jail:\r\n```\r\nmimmi$ sudo fail2ban-client status sshd\r\n[sudo] password for root: \r\nStatus for the jail: sshd\r\n|- Filter\r\n|  |- Currently failed: 0\r\n|  |- Total failed:     0\r\n|  `- Journal matches:  _SYSTEMD_UNIT=sshd.service + _COMM=sshd\r\n`- Actions\r\n   |- Currently banned: 0\r\n   |- Total banned:     0\r\n   `- Banned IP list:\r\n```\r\n#### Any customizations done to /etc/fail2ban/ configuration\r\nI've done these relevant customizations in `jail.local`\r\n```\r\n[DEFAULT]\r\nbantime = 86400\r\nbackend = systemd\r\n…\r\n[sshd]\r\nenabled = true\r\n…\r\n```\r\n(Several other jails are also enabled, excluded here.)\r\n#### Relevant parts of /var/log/fail2ban.log file:\r\nThe only thing that shows up are the standard messages at startup, like these:\r\n```\r\n2016-02-29 19:00:05,535 fail2ban.jail           [24435]: INFO    Creating new jail 'sshd'\r\n2016-02-29 19:00:05,558 fail2ban.jail           [24435]: INFO    Jail 'sshd' uses systemd\r\n2016-02-29 19:00:05,581 fail2ban.jail           [24435]: INFO    Initiated 'systemd' backend\r\n2016-02-29 19:00:06,902 fail2ban.filter         [24435]: INFO    Set maxRetry = 5\r\n2016-02-29 19:00:06,905 fail2ban.actions        [24435]: INFO    Set banTime = 86400\r\n2016-02-29 19:00:06,907 fail2ban.filter         [24435]: INFO    Set findtime = 600\r\n2016-02-29 19:00:06,908 fail2ban.filter         [24435]: INFO    Set maxlines = 10\r\n2016-02-29 19:00:07,015 fail2ban.filtersystemd  [24435]: INFO    Added journal match for: '_SYSTEMD_UNIT=sshd.service + _COMM=sshd'\r\n```\r\n\r\n#### Relevant lines from monitored log files in question:\r\nIf I try that journal match myself, I get several lines, some of which ought to match\r\n```\r\nmimmi$ journalctl --since today _SYSTEMD_UNIT=sshd.service + _COMM=sshd\r\n…\r\nfeb 29 03:22:13 mimmi sshd[1180]: User root from 183.3.202.104 not allowed because not listed in AllowUsers\r\n…\r\n```"},"comment":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/comments/192489776","html_url":"https://github.com/fail2ban/fail2ban/issues/1341#issuecomment-192489776","issue_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1341","id":192489776,"user":{"login":"yarikoptic","id":39889,"avatar_url":"https://avatars.githubusercontent.com/u/39889?v=3","gravatar_id":"","url":"https://api.github.com/users/yarikoptic","html_url":"https://github.com/yarikoptic","followers_url":"https://api.github.com/users/yarikoptic/followers","following_url":"https://api.github.com/users/yarikoptic/following{/other_user}","gists_url":"https://api.github.com/users/yarikoptic/gists{/gist_id}","starred_url":"https://api.github.com/users/yarikoptic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yarikoptic/subscriptions","organizations_url":"https://api.github.com/users/yarikoptic/orgs","repos_url":"https://api.github.com/users/yarikoptic/repos","events_url":"https://api.github.com/users/yarikoptic/events{/privacy}","received_events_url":"https://api.github.com/users/yarikoptic/received_events","type":"User","site_admin":false},"created_at":"2016-03-04T22:06:30Z","updated_at":"2016-03-04T22:06:30Z","body":"aha... indeed and here you are using systemd backend and it could well be that it doesn't care about \"logencoding\".  I will check"}}