Where Does Fail2ban Store Jails, Bans, and Logs?
Where Fail2ban keeps jail configs, the live database, and logs on Linux, and which files to edit versus leave alone.
Last updated
Fail2ban splits config into shipped defaults and your overrides. The package owns jail.conf and filter files; you own jail.local and fail2ban.local in /etc/fail2ban. Upgrades replace the first set and preserve the second.
Runtime state lives elsewhere: bans in a SQLite database under /var/lib/fail2ban, activity in /var/log/fail2ban.log. Knowing which of the three trees a problem sits in (config, database, or log) cuts most troubleshooting down to one directory. The client status command shows live bans per jail.
Where Fail2ban stores this, by platform
/etc/fail2ban
jail.local and fail2ban.local are yours; jail.conf, action.d/, and filter.d/ belong to the package. Distros may split the tree across /etc/fail2ban cleanly. Always test with fail2ban-client ping before assuming a silent daemon.
Frequently asked questions
which fail2ban config files should i edit
Only jail.local (your overrides) and fail2ban.local. Never edit jail.conf directly; package upgrades overwrite it. Copy the options you need from jail.conf into jail.local and change them there. fail2ban-client reload applies the merge.
where is the fail2ban database
In the SQLite database at /var/lib/fail2ban/fail2ban.sqlite3. It records bans across restarts when dbpurgeage allows. Deleting it with the service stopped clears all bans at once, which is the fastest unbrick after locking yourself out.
where are fail2ban logs
In /var/log/fail2ban.log. It records every ban, unban, and filter error with timestamps. A jail that never fires almost always has a broken regex visible here. Logrotate manages the archives beside it.
Notice an outdated path? Let us know.