Free tools Windows power users keep installed
One-click scans. No signup required.
Prometheus does not read Fail2ban’s Unix socket directly. A Fail2ban exporter reads that socket and serves metrics over HTTP; Prometheus then scrapes the exporter’s endpoint. To find the break, check whether Prometheus has a target, whether the endpoint is reachable, and whether the exporter can access Fail2ban’s socket.
How Fail2ban metrics reach Prometheus
The data path has two separate connections:
- Exporter to Fail2ban: The exporter connects to Fail2ban through its Unix socket and collects data.
- Prometheus to exporter: Prometheus makes an HTTP request to the exporter’s metrics endpoint, normally
/metrics.
A working scrape proves that Prometheus reached an HTTP endpoint; it does not by itself prove that the exporter successfully read Fail2ban. Likewise, a working socket connection does not mean Prometheus can reach the exporter over the network.
As an Amazon Associate I earn from qualifying purchases.
Check whether Prometheus has discovered the target
Open Prometheus’s Targets status page or query /api/v1/targets. The API reports active and dropped targets and shows labels after relabeling. If the Fail2ban target is absent, investigate configuration or discovery before debugging the socket.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Confirm the scrape job is in the configuration Prometheus actually loaded.
- Check the job’s static target or service-discovery settings.
- Review relabeling rules that might drop the target.
Prometheus documents target inspection and the targets API at its HTTP API reference.
#1 Best Overall
Configure the scrape job for the exporter
Point Prometheus at the exporter’s reachable host and port, not at Fail2ban’s socket. This example assumes the exporter is reachable as fail2ban-exporter on port 9191; that port is used by the hctrdev exporter example, not a universal default.
scrape_configs:
- job_name: fail2ban
static_configs:
- targets: ['fail2ban-exporter:9191']Prometheus uses /metrics by default, so no path setting is needed for a standard exporter endpoint. Replace the example target with the address and port that Prometheus itself can resolve and reach. On a shared Docker network, that may be the exporter’s service name. For an exporter installed on the host, use an address routable from the Prometheus process or container. See Prometheus scrape configuration documentation.
Use the target error to find the failing link
| What you see | What to check next |
|---|---|
| No target listed | Loaded scrape configuration, target discovery, and relabeling. Check the targets API for active and dropped targets. |
| Connection refused or timeout | Whether the exporter is running and listening on the configured interface and port, and whether Prometheus can route to that address. |
| HTTP 404 or an unexpected response | Whether the target is the exporter and the request uses the correct metrics path. The default is /metrics. |
| Target is up, but Fail2ban metrics are missing | The actual endpoint response, exporter logs or error metrics, and the exporter’s connection to the intended Fail2ban instance. |
| Exporter reports a socket error | The configured socket path, container mount, and permissions available to the exporter process. |
Test the endpoint from the same network context as Prometheus—for example, from inside its container if Prometheus runs in Docker. A request that succeeds from the Docker host does not establish that a Prometheus container can reach the same host address. Use the deployment’s resolvable, routable address.
Recommended Free Tools
Check the exporter’s Fail2ban socket access
If Prometheus can scrape the exporter but Fail2ban data are missing, verify the socket path configured for the exporter and confirm that the exporter process can access it. The hctrdev exporter README identifies a wrong path or an incorrect Docker mount as possible causes of a “no such file or directory” error. If the socket exists, permissions may be preventing access.
- Compare the socket path expected by the exporter with the path available in its runtime environment.
- Check that the exporter’s user has the access it needs. The hctrdev README discusses running with appropriate access, changing the Fail2ban service user, or relaxing socket permissions; choose an approach that fits your security requirements.
- Account for socket recreation: permissions can revert when Fail2ban recreates the socket after a restart.
For Docker, mount the socket’s parent directory, such as /var/run/fail2ban, rather than mounting only fail2ban.sock. Fail2ban can delete and recreate the socket during shutdown or startup, leaving a direct file mount pointing at the old socket. Ensure the exporter sees the recreated socket at the path it is configured to use. See the hctrdev Fail2Ban Prometheus Exporter README.
Inspect the metrics the exporter actually serves
Once the target is up, inspect its HTTP response before writing queries or alerts. The hctrdev exporter documents metrics including f2b_up, f2b_errors, f2b_jail_count, and per-jail current and total ban and failure counts. Names and collection behavior vary by exporter: the cfuk project documents a textfile mode as well as exporter metrics. Do not assume one project’s metric names apply to another.
Rank #4
Different approaches also have different collection and deployment requirements. A live HTTP exporter reads the socket; a textfile approach has a different collection path. Check the selected project’s documentation for its supported mode, socket or file requirements, access controls, and compatibility with your installed version. The available project documentation does not establish one implementation as universally preferable. See the cfuk exporter README.
Reload configuration and verify the fix
Prometheus can reload configuration on SIGHUP or through /-/reload if the lifecycle flag is enabled. A malformed configuration is not applied. After reloading, revisit the Targets page and query a metric name that the selected exporter actually exposes. Prometheus documents the reload behavior in its management API documentation.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
