Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Fail2ban’s SSH jail counters show failed events its configured filter matched and bans it applied or recorded. They do not count every SSH probe, identify unique attackers, or prove whether anyone logged in successfully. Read them as a report of what one jail observed—not as a complete measure of attacks against a server.
How to check Fail2ban’s SSH counters
For a jail named sshd, query that jail directly. The Fail2ban v1.1.2.dev1 manual, dated August 2026, documents these commands; options and displayed fields can vary by installed version, so check your package’s help or manual if the output differs.
As an Amazon Associate I earn from qualifying purchases.
fail2ban-client status— view server status and the list of jails.fail2ban-client status sshd— view status for thesshdjail. Substitute the actual jail name if yours differs.fail2ban-client status --all— view status for all jails.fail2ban-client statistics— view current statistics across jails. The project changelog describes its statistics table as including jail, backend, found, and banned counts.
These commands report what Fail2ban is tracking; they do not independently verify that a firewall or other ban action is blocking traffic.
What “failed” and “banned” mean
Failed and banned counters describe different stages. A matching failure can be counted without its source reaching the jail’s ban threshold.
#1 Best Overall
| Field | What it indicates | What it does not establish |
|---|---|---|
| Currently failed | A current or windowed filter count shown in jail status. | It is not the lifetime number of SSH attempts. |
| Total failed | The accumulated failed-match count reported by the jail over its tracking period. | The client output alone does not define a universal “all time” boundary. |
| Currently banned | Addresses currently held under a ban in that jail’s action state. | It does not independently prove the network rule is enforcing the ban. |
| Total banned | The total ban count reported by the jail. | It is not necessarily a count of unique addresses: an address may be banned again after a ban expires or is removed. |
The exact reset and persistence behavior depends on Fail2ban version, database settings, and jail lifecycle. The manual documents database storage and the dbpurgeage ban-history retention control; do not assume a Total counter always means all-time activity.
What the counters reveal about SSH activity
Fail2ban monitors configured log files or systemd journals and looks for entries matching a jail’s filter. It records matching events as failures. When a source reaches the configured maxretry number of failures within findtime, Fail2ban runs the jail’s configured ban action.
So a high Total failed count indicates repeated matching authentication-failure events in that jail’s accounting. A rising ban count indicates that sources have met the configured thresholds often enough for bans to be invoked. Those counters speak only to activity visible in the jail’s selected inputs and recognized by its filter.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- They do not include activity outside the configured logs or journal.
- They do not by themselves show successful logins, attacker identity, or attack sophistication.
- They are not an Internet-wide estimate of SSH brute-force volume.
- A ban count is not a unique-IP count unless you separately calculate and label unique addresses.
Fail2ban’s project README puts the security limitation plainly: “Though Fail2Ban is able to reduce the rate of incorrect authentication attempts, it cannot eliminate the risk presented by weak authentication.”
Why a failure count may not produce a ban
Fail2ban applies a ban only when the configured threshold is met: maxretry failures during findtime. The project wiki illustrates this logic with five failures within ten minutes. That is an example, not a universal default for every installation. Raising or lowering either setting changes how readily bans occur and can also change the risk of false positives.
If failures appear but bans do not, check the effective jail settings, threshold, and action. The project wiki warns that a faulty ban action can leave an attacker able to connect even when Fail2ban has logged a ban. Treat a “Ban” log entry as evidence that the action was invoked, not independent proof of successful firewall enforcement.
Rank #4
Why zero counts can be misleading
A zero does not prove that no one has tried to connect. The project wiki lists several possibilities to check:
- The jail is inactive or missing.
- The configured backend, log path, or journal match is wrong.
- There have not been enough failures to reach the threshold.
- The date or time pattern does not match the log entries.
- The filter expression fails to match the entries.
The jail manual documents skip or error behavior when no configured log path matches, as well as fallback conditions for the systemd backend. Time parsing can also affect windowed counts: log lines without an explicit timezone are interpreted using Fail2ban’s system timezone unless configured otherwise. The manual recommends having services emit explicit timezone offsets where possible.
Best Value
- Used Book in Good Condition
How to compare counts across servers or time periods
Raw counts are not meaningful comparisons unless the measurement setup is comparable. Before drawing a conclusion, align these factors:
- Jail and input: Compare the same jail and the same log source or backend.
- Observation period: Use the same interval and account for timezone handling.
- Thresholds: Compare
maxretryandfindtimesettings. - Counter meaning: Keep current/windowed counts separate from cumulative counts.
- Address analysis: If you calculate unique IPs or per-IP rates, state the method, interval, and denominator. These are not equivalent to raw found or banned counters.
Without those controls, a higher count may reflect different logging, filters, thresholds, or accounting periods—not necessarily more attack activity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
