Fail2ban Jail启动后无连接记录显示问题求助

大家好，我在Ubuntu服务器上部署了fail2ban，目前遇到了一个奇怪的问题，想请各位帮忙看看：

现状说明 #

1. Fail2ban启动状态正常
   查看fail2ban.log显示服务启动成功，sshd jail也完成创建并启动：

   2023-12-07 14:55:27,758 fail2ban.server         [803]: INFO    --------------------------------------------------
   2023-12-07 14:55:27,758 fail2ban.server         [803]: INFO    Starting Fail2ban v0.11.2
   2023-12-07 14:55:27,759 fail2ban.observer       [803]: INFO    Observer start...
   2023-12-07 14:55:27,767 fail2ban.database       [803]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
   2023-12-07 14:55:27,768 fail2ban.database       [803]: WARNING New database created. Version '4'
   2023-12-07 14:55:27,769 fail2ban.jail           [803]: INFO    Creating new jail 'sshd'
   2023-12-07 14:55:27,778 fail2ban.jail           [803]: INFO    Jail 'sshd' uses pyinotify {}
   2023-12-07 14:55:27,779 fail2ban.jail           [803]: INFO    Initiated 'pyinotify' backend
   2023-12-07 14:55:27,780 fail2ban.filter         [803]: INFO      maxLines: 1
   2023-12-07 14:55:27,790 fail2ban.filter         [803]: INFO      maxRetry: 5
   2023-12-07 14:55:27,790 fail2ban.filter         [803]: INFO      findtime: 600
   2023-12-07 14:55:27,790 fail2ban.actions        [803]: INFO      banTime: 600
   2023-12-07 14:55:27,790 fail2ban.filter         [803]: INFO      encoding: UTF-8
   2023-12-07 14:55:27,790 fail2ban.filter         [803]: INFO    Added logfile: '/var/log/auth.log' (pos = 0, hash = dbc10cda87971348abf435b463c625fcaf25d6de)
   2023-12-07 16:32:52,352 fail2ban.jail           [3466]: INFO    Creating new jail 'sshd'
   2023-12-07 16:32:52,354 fail2ban.jail           [3466]: INFO    Jail 'sshd' uses poller {}
   2023-12-07 16:32:52,354 fail2ban.jail           [3466]: INFO    Initiated 'polling' backend
   2023-12-07 16:32:52,354 fail2ban.filter         [3466]: INFO      maxLines: 1
   2023-12-07 16:32:52,361 fail2ban.filter         [3466]: INFO      maxRetry: 3
   2023-12-07 16:32:52,361 fail2ban.filter         [3466]: INFO      findtime: 900
   2023-12-07 16:32:52,361 fail2ban.actions        [3466]: INFO      banTime: 900
   2023-12-07 16:32:52,361 fail2ban.filter         [3466]: INFO      encoding: UTF-8
   2023-12-07 16:32:52,361 fail2ban.filter         [3466]: INFO    Added logfile: '/var/log/auth.log' (pos = 106290, hash = dbc10cda87971348abf435b463c625fcaf25d6de)
   2023-12-07 16:32:52,362 fail2ban.jail           [3466]: INFO    Jail 'sshd' started
   

2. Jail状态检查正常
   执行sudo fail2ban-client status返回结果显示有1个jail在运行，正是sshd：

   Status
   |- Number of jail:  1
   `- Jail list:   sshd
   

3. 自定义了sshd Jail配置
   我在fail2ban的jail配置文件中添加了以下内容（注：原文误写为添加到/var/log/fail2ban.log，应为jail配置文件如jail.local）：

   [sshd]
   # To use more aggressive sshd modes set filter parameter "mode" in jail.local:
   # normal (default), ddos, extra or aggressive (combines all).
   # See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
   #mode   = normal
   enabled = true
   port    = ssh
   backend = polling
   filter = sshd
   logpath = /var/log/auth.log
   bantime = 900
   banaction = iptables-allports
   findtime = 900
   maxretry = 3
   

问题描述 #

自从2023-12-07 16:32:52日志显示Jail 'sshd' started之后，fail2ban.log里就再也没有新的记录生成。我用MacBook多次尝试SSH连接服务器，这些连接记录都能在/var/log/auth.log里正常看到，但fail2ban完全没有在自身日志中记录任何相关的检测动作或事件。

请问有没有人遇到过类似的问题？或者能指点一下我该从哪些方向排查原因？

备注：内容来源于stack exchange，提问作者João Sacramento