[BR]: Enabling a jail that uses systemd backend while empty systemd journal files are present triggers an error.
Author: juozaspoCreated Sep 11, 2026Updated Sep 17, 2026
Labels3rd party issuebug
Environment:
- Fail2Ban version : 1.1.1-1~upstream2 deb package
- OS, including release name/version : Debian 13 (trixie) on VPS server
- Fail2Ban installed via OS/distribution mechanisms
- You have not applied any additional foreign patches to the codebase
- Some customizations were done to the configuration (provide details below is so)
The issue:
Enabling a jail using systemd backend while empty (0 bytes) journal files are present in the system triggers a systemd error OSError(61, 'No data available') in fail2ban log as soon as service is restarted and/or reloaded. Fail2ban package file downloaded from github releases page.
Steps to reproduce
- Download and install latest deb release (
fail2ban_1.1.1-1.upstream2_all.deb) from github into Debian based system (runapt-get install ./fail2ban_1.1.1-1.upstream2_all.deb, not forgetting to add./before package file name) or otherwise install on different distro where deb not used for packages - Modify config to enable any jail like sshd or any other and to add extra debugging incase it would fail
- Make sure empty file(s) exist in
/var/log/journalsubdirectories (usually generated by improper installation or other likely cause) - Reload systemd service by running
systemctl reload fail2ban.service
Expected behavior
No error output in terminal after running systemctl reload command
Observed behavior
# systemctl reload fail2ban.service
Job for fail2ban.service failed.
See "systemctl status fail2ban.service" and "journalctl -xeu fail2ban.service" for details.Any additional information
Configuration, dump and another helpful excerpts
Any customizations done to /etc/fail2ban/ configuration
/etc/fail2ban/jail.local
[sshd]
#enable sshd jail
enabled = 1/etc/fail2ban/fail2ban.local
[DEFAULT]
#extra debug for troubleshooting
loglevel = DEBUGRelevant parts of /var/log/fail2ban.log file:
2026-09-11 18:03:55,392 fail2ban.server [5387]: INFO Reload all jails
2026-09-11 18:03:55,393 fail2ban.ipdns [5387]: DEBUG IPv6 is auto
2026-09-11 18:03:55,393 fail2ban.jail [5387]: INFO Creating new jail 'sshd'
2026-09-11 18:03:55,393 fail2ban.jail [5387]: INFO Jail 'sshd' uses systemd {}
2026-09-11 18:03:55,407 fail2ban.utils [5387]: DEBUG 7f4de8958d00 -- stdout: '/var/log'
2026-09-11 18:03:55,408 fail2ban.utils [5387]: DEBUG 7f4de8958d00 -- returned successfully 0
2026-09-11 18:03:55,423 fail2ban.utils [5387]: DEBUG 7f4de8958e40 -- stdout: '/run/log'
2026-09-11 18:03:55,423 fail2ban.utils [5387]: DEBUG 7f4de8958e40 -- returned successfully 0
2026-09-11 18:03:55,424 fail2ban.filter [5387]: DEBUG Setting usedns = warn for FilterSystemd(Jail('sshd'))
2026-09-11 18:03:55,424 fail2ban.filter [5387]: DEBUG Created FilterSystemd(Jail('sshd'))
2026-09-11 18:03:55,424 fail2ban.server [5387]: INFO Reload finished.
2026-09-11 18:03:55,424 fail2ban.transmitter [5387]: ERROR Command ['reload', '--all', [], [['set', 'syslogsocket', 'auto'], ['set', 'loglevel', 'DEBUG'], ['set', 'logtarget', '/var/log/fail2ban.log'], ['set', 'allowipv6', 'auto'], ['set', 'dbfile', '/var/lib/fail2ban/fail2ban.sqlite3'], ['set', 'dbmaxmatches', 10], ['set', 'dbpurgeage', '1d'], ['add', 'sshd', 'systemd'], ['set', 'sshd', 'usedns', 'warn'], ['set', 'sshd', 'prefregex', '^<F-MLFID>\\s*(?:\\S+\\s+)?(?:sshd(?:-session)?(?:\\[\\d+\\])?:?\\s+)?(?:kernel:\\s?\\[ *\\d+\\.\\d+\\]:?\\s+)?</F-MLFID>(?:(?:error|fatal): (?:PAM: )?)?<F-CONTENT>.+</F-CONTENT>$'], ['set', 'sshd', 'maxlines', 1], ['multi-set', 'sshd', 'addfailregex', ['^[aA]uthentication (?:failure|error|failed) for <F-USER>.*?</F-USER> (?:from )?<HOST>( via \\S+)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User not known to the underlying authentication module for <F-USER>.*?</F-USER> (?:from )?<HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^Failed publickey for invalid user <F-USER>(?P<cond_user>\\S+)|(?:(?! from ).)*?</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)', '^Failed (?:<F-NOFAIL>publickey</F-NOFAIL>|\\S+) for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)', '^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>', '^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> (?:from )?<HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not listed in AllowUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because listed in DenyUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not in any group(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^refused connect from \\S+ \\(<HOST>\\)', '^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*3: .*: Auth fail(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because a group is listed in DenyGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', "^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because none of user's groups are listed in AllowGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$", '^<F-NOFAIL>pam_[a-z]+\\(sshd:auth\\):\\s+authentication failure;</F-NOFAIL>(?:\\s+(?:(?:logname|e?uid|tty)=\\S*)){0,4}\\s+ruser=<F-ALT_USER>\\S*</F-ALT_USER>\\s+rhost=<HOST>(?:\\s+user=<F-USER>\\S*</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^maximum authentication attempts exceeded for (?:invalid user )?<F-USER>.*?</F-USER> (?:from )?<HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> not allowed because account is locked(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*', '^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\\S+</F-USER> <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*Change of username or service not allowed:\\s*.*\\[preauth\\]\\s*$', '^Disconnecting: Too many authentication failures(?: for <F-USER>\\S+|.*?</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*11:', '^<F-NOFAIL><F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET></F-NOFAIL>(?: (?:by|from))?(?: (?:invalid|authenticating) user <F-USER>\\S+|.*?</F-USER>)?(?: from)? <ADDR>(?: (?:port \\d+|on \\S+)){0,2}(?:: (?!Too many authentication failures)[^\\[]+)?(?: \\[preauth\\])?\\s*$', '^<F-MLFFORGET><F-MLFGAINED>Accepted \\w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\\S+</F-USER> from <HOST>(?:\\s|$)', '^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>']], ['set', 'sshd', 'datepattern', '{^LN-BEG}'], ['set', 'sshd', 'addjournalmatch', '_SYSTEMD_UNIT=ssh.service', '+', '_COMM=sshd', '+', '_COMM=sshd-session'], ['set', 'sshd', 'maxretry', 5], ['set', 'sshd', 'maxmatches', 5], ['set', 'sshd', 'findtime', '10m'], ['set', 'sshd', 'bantime', '10m'], ['set', 'sshd', 'ignorecommand', ''], ['set', 'sshd', 'logencoding', 'auto'], ['set', 'sshd', 'addaction', 'nftables'], ['multi-set', 'sshd', 'action', 'nftables', [['actionstart', 'nft add table inet f2b-table\nnft -- add chain inet f2b-table f2b-chain \\{ type filter hook input priority -1 \\; \\}\nnft add set inet f2b-table <addr_set> \\{ type <addr_type>\\;<sp>flags interval\\; \\}\nif [ \'tcp\' != "all" ]; then\nfor proto in $(echo \'tcp\' | sed \'s/,/ /g\'); do\nnft add rule inet f2b-table f2b-chain $proto dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\ndone\nelse\nnft add rule inet f2b-table f2b-chain th dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\nfi'], ['actionstop', "{ nft -a list chain inet f2b-table f2b-chain | sed -nE 's/.*@<addr_set>\\s+.*\\s+\\#\\s*(handle\\s+[0-9]+)$/\\1/p'; } | while read -r hdl; do\nnft delete rule inet f2b-table f2b-chain $hdl; done\nnft delete set inet f2b-table <addr_set>\n{ nft list table inet f2b-table | grep -qE '^\\s+set\\s+'; } || {\nnft delete table inet f2b-table\n}"], ['actionflush', '{ nft flush set inet f2b-table <addr_set> 2> /dev/null; } || {\n{ nft -a list chain inet f2b-table f2b-chain | sed -nE \'s/.*@<addr_set>\\s+.*\\s+\\#\\s*(handle\\s+[0-9]+)$/\\1/p\'; } | while read -r hdl; do\nnft delete rule inet f2b-table f2b-chain $hdl; done\nnft delete set inet f2b-table <addr_set>\nnft add set inet f2b-table <addr_set> \\{ type <addr_type>\\;<sp>flags interval\\; \\}\nif [ \'tcp\' != "all" ]; then\nfor proto in $(echo \'tcp\' | sed \'s/,/ /g\'); do\nnft add rule inet f2b-table f2b-chain $proto dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\ndone\nelse\nnft add rule inet f2b-table f2b-chain th dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\nfi\n}'], ['actioncheck', "nft list chain inet f2b-table f2b-chain | grep -q '@<addr_set>[ \\t]'"], ['actionban', 'nft add element inet f2b-table <addr_set> \\{ <ip> \\}'], ['actionunban', 'nft delete element inet f2b-table <addr_set> \\{ <ip> \\}'], ['port', 'ssh'], ['protocol', 'tcp'], ['chain', '<known/chain>'], ['name', 'sshd'], ['actname', 'nftables'], ['table', 'f2b-table'], ['table_family', 'inet'], ['chain_type', 'filter'], ['chain_hook', 'input'], ['chain_priority', '-1'], ['addr_type', 'ipv4_addr'], ['blocktype', 'reject'], ['nftables', 'nft'], ['addr_set', 'addr-set-<name>'], ['addr_family', 'ip'], ['addr_options', '<sp>flags interval\\;'], ['addr_family?family=inet6', 'ip6'], ['addr_type?family=inet6', 'ipv6_addr'], ['addr_set?family=inet6', 'addr6-set-<name>']]], ['start', 'sshd']]] has failed. Received OSError(61, 'No data available')
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/fail2ban/server/transmitter.py", line 58, in proceed
ret = self.__commandHandler(command)
File "/usr/lib/python3/dist-packages/fail2ban/server/transmitter.py", line 109, in __commandHandler
self.__commandHandler(cmd)
~~~~~~~~~~~~~~~~~~~~~^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/transmitter.py", line 84, in __commandHandler
self.__server.addJail(name, backend)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/server.py", line 253, in addJail
self.__jails.add(name, backend, self.__db)
~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/jails.py", line 72, in add
self._jails[name] = Jail(name, backend, db)
~~~~^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/jail.py", line 86, in __init__
self._realBackend = self._setBackend(backend)
~~~~~~~~~~~~~~~~^^^^^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/jail.py", line 110, in _setBackend
initmethod(**beArgs)
~~~~~~~~~~^^^^^^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/jail.py", line 145, in _initSystemd
self.__filter = FilterSystemd(self, **kwargs)
~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/fail2ban/server/filtersystemd.py", line 105, in __init__
self.__journal = journal.Reader(**self.__jrnlargs)
~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/systemd/journal.py", line 175, in __init__
super(Reader, self).__init__(flags, path, files, namespace)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
OSError: [Errno 61] No data availableRelevant lines from monitored log files:
Sep 11 16:39:31 server.juozas24.lt sshd-session[5120]: reverse mapping checking getaddrinfo for static.cmcti.vn [45.122.242.218] failed.
Sep 11 16:39:31 server.juozas24.lt sshd-session[5120]: reverse mapping checking getaddrinfo for static.cmcti.vn [45.122.242.218] failed.
Sep 11 16:39:31 server.juozas24.lt sshd-session[5120]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.122.242.218 user=root
Sep 11 16:39:33 server.juozas24.lt sshd-session[5120]: Failed password for root from 45.122.242.218 port 11014 ssh2
Sep 11 16:39:34 server.juozas24.lt sshd-session[5120]: Connection closed by authenticating user root 45.122.242.218 port 11014 [preauth]
Sep 11 17:24:58 server.juozas24.lt sshd-session[5214]: reverse mapping checking getaddrinfo for static.cmcti.vn [45.122.242.218] failed.
Sep 11 17:24:58 server.juozas24.lt sshd-session[5214]: reverse mapping checking getaddrinfo for static.cmcti.vn [45.122.242.218] failed.
Sep 11 17:24:58 server.juozas24.lt sshd-session[5214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.122.242.218 user=root
Sep 11 17:25:00 server.juozas24.lt sshd-session[5214]: Failed password for root from 45.122.242.218 port 27824 ssh2
Sep 11 17:25:01 server.juozas24.lt sshd-session[5214]: Connection closed by authenticating user root 45.122.242.218 port 27824 [preauth]
Sep 11 18:04:39 server.juozas24.lt sshd-session[5661]: Connection closed by 176.105.201.62 port 62108
Sep 11 18:11:33 server.juozas24.lt sshd-session[5726]: Connection closed by 102.35.147.195 port 60212
Sep 11 18:11:41 server.juozas24.lt sshd-session[5727]: Connection closed by 102.35.147.195 port 40198output of command fail2ban-client -d | grep sshd
['add', 'sshd', 'systemd']
['set', 'sshd', 'usedns', 'warn']
['set', 'sshd', 'prefregex', '^<F-MLFID>\\s*(?:\\S+\\s+)?(?:sshd(?:-session)?(?:\\[\\d+\\])?:?\\s+)?(?:kernel:\\s?\\[ *\\d+\\.\\d+\\]:?\\s+)?</F-MLFID>(?:(?:error|fatal): (?:PAM: )?)?<F-CONTENT>.+</F-CONTENT>$']
['set', 'sshd', 'maxlines', 1]
['multi-set', 'sshd', 'addfailregex', ['^[aA]uthentication (?:failure|error|failed) for <F-USER>.*?</F-USER> (?:from )?<HOST>( via \\S+)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User not known to the underlying authentication module for <F-USER>.*?</F-USER> (?:from )?<HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^Failed publickey for invalid user <F-USER>(?P<cond_user>\\S+)|(?:(?! from ).)*?</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)', '^Failed (?:<F-NOFAIL>publickey</F-NOFAIL>|\\S+) for (?P<cond_inv>invalid user )?<F-USER>(?P<cond_user>\\S+)|(?(cond_inv)(?:(?! from ).)*?|[^:]+)</F-USER> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?(cond_user): |(?:(?:(?! from ).)*)$)', '^<F-USER>ROOT</F-USER> LOGIN REFUSED FROM <HOST>', '^[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> (?:from )?<HOST>(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not listed in AllowUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because listed in DenyUsers(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because not in any group(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^refused connect from \\S+ \\(<HOST>\\)', '^Received <F-MLFFORGET>disconnect</F-MLFFORGET> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*3: .*: Auth fail(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because a group is listed in DenyGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', "^User <F-USER>\\S+|.*?</F-USER> (?:from )?<HOST> not allowed because none of user's groups are listed in AllowGroups(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$", '^<F-NOFAIL>pam_[a-z]+\\(sshd:auth\\):\\s+authentication failure;</F-NOFAIL>(?:\\s+(?:(?:logname|e?uid|tty)=\\S*)){0,4}\\s+ruser=<F-ALT_USER>\\S*</F-ALT_USER>\\s+rhost=<HOST>(?:\\s+user=<F-USER>\\S*</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^maximum authentication attempts exceeded for (?:invalid user )?<F-USER>.*?</F-USER> (?:from )?<HOST>(?: (?:port \\d+|on \\S+)){0,2}(?: ssh\\d*)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^User <F-USER>\\S+|.*?</F-USER> not allowed because account is locked(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*', '^<F-MLFFORGET>Disconnecting</F-MLFFORGET>(?: from)?(?: (?:invalid|authenticating)) user <F-USER>\\S+</F-USER> <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*Change of username or service not allowed:\\s*.*\\[preauth\\]\\s*$', '^Disconnecting: Too many authentication failures(?: for <F-USER>\\S+|.*?</F-USER>)?(?: (?:port \\d+|on \\S+|\\[preauth\\])){0,3}\\s*$', '^<F-NOFAIL>Received <F-MLFFORGET>disconnect</F-MLFFORGET></F-NOFAIL> from <HOST>(?: (?:port \\d+|on \\S+)){0,2}:\\s*11:', '^<F-NOFAIL><F-MLFFORGET>(?:Connection (?:closed|reset)|Disconnect(?:ed|ing))</F-MLFFORGET></F-NOFAIL>(?: (?:by|from))?(?: (?:invalid|authenticating) user <F-USER>\\S+|.*?</F-USER>)?(?: from)? <ADDR>(?: (?:port \\d+|on \\S+)){0,2}(?:: (?!Too many authentication failures)[^\\[]+)?(?: \\[preauth\\])?\\s*$', '^<F-MLFFORGET><F-MLFGAINED>Accepted \\w+</F-MLFGAINED></F-MLFFORGET> for <F-USER>\\S+</F-USER> from <HOST>(?:\\s|$)', '^<F-NOFAIL>Connection from</F-NOFAIL> <HOST>']]
['set', 'sshd', 'datepattern', '{^LN-BEG}']
['set', 'sshd', 'addjournalmatch', '_SYSTEMD_UNIT=ssh.service', '+', '_COMM=sshd', '+', '_COMM=sshd-session']
['set', 'sshd', 'maxretry', 5]
['set', 'sshd', 'maxmatches', 5]
['set', 'sshd', 'findtime', '10m']
['set', 'sshd', 'bantime', '10m']
['set', 'sshd', 'ignorecommand', '']
['set', 'sshd', 'logencoding', 'auto']
['set', 'sshd', 'addaction', 'nftables']
['multi-set', 'sshd', 'action', 'nftables', [['actionstart', 'nft add table inet f2b-table\nnft -- add chain inet f2b-table f2b-chain \\{ type filter hook input priority -1 \\; \\}\nnft add set inet f2b-table <addr_set> \\{ type <addr_type>\\;<sp>flags interval\\; \\}\nif [ \'tcp\' != "all" ]; then\nfor proto in $(echo \'tcp\' | sed \'s/,/ /g\'); do\nnft add rule inet f2b-table f2b-chain $proto dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\ndone\nelse\nnft add rule inet f2b-table f2b-chain th dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\nfi'], ['actionstop', "{ nft -a list chain inet f2b-table f2b-chain | sed -nE 's/.*@<addr_set>\\s+.*\\s+\\#\\s*(handle\\s+[0-9]+)$/\\1/p'; } | while read -r hdl; do\nnft delete rule inet f2b-table f2b-chain $hdl; done\nnft delete set inet f2b-table <addr_set>\n{ nft list table inet f2b-table | grep -qE '^\\s+set\\s+'; } || {\nnft delete table inet f2b-table\n}"], ['actionflush', '{ nft flush set inet f2b-table <addr_set> 2> /dev/null; } || {\n{ nft -a list chain inet f2b-table f2b-chain | sed -nE \'s/.*@<addr_set>\\s+.*\\s+\\#\\s*(handle\\s+[0-9]+)$/\\1/p\'; } | while read -r hdl; do\nnft delete rule inet f2b-table f2b-chain $hdl; done\nnft delete set inet f2b-table <addr_set>\nnft add set inet f2b-table <addr_set> \\{ type <addr_type>\\;<sp>flags interval\\; \\}\nif [ \'tcp\' != "all" ]; then\nfor proto in $(echo \'tcp\' | sed \'s/,/ /g\'); do\nnft add rule inet f2b-table f2b-chain $proto dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\ndone\nelse\nnft add rule inet f2b-table f2b-chain th dport \\{ $(echo \'ssh\' | sed s/:/-/g) \\} <addr_family> saddr @<addr_set> reject\nfi\n}'], ['actioncheck', "nft list chain inet f2b-table f2b-chain | grep -q '@<addr_set>[ \\t]'"], ['actionban', 'nft add element inet f2b-table <addr_set> \\{ <ip> \\}'], ['actionunban', 'nft delete element inet f2b-table <addr_set> \\{ <ip> \\}'],Source: fail2ban/fail2ban