Three jails enabled, two of them watching log files that moved when the services were containerised.
$ fail2ban-client status
Jail list: sshd, nginx-http-auth, nginx-botsearch
$ fail2ban-client status nginx-http-auth
Currently failed: 0
Total failed: 0 ← since 2022
File list: /var/log/nginx/error.log
$ ls -la /var/log/nginx/error.log
ls: cannot access: No such file or directory
# nginx logs to stdout, collected by the container runtime
A jail watching a file that does not exist reports zero failures, which is indistinguishable from a jail that is working. The total-failed counter is the diagnostic and nothing surfaces it — the fix was a log driver writing to a file the host can read, and a check that asserts each jail has banned something in the last ninety days.