Environment:

• Fail2Ban version (including any possible distribution suffixes): 0.10.2-2.1
• OS, including release name/version: Debian 10
• Fail2Ban installed via OS/distribution mechanisms
• You have not applied any additional foreign patches to the codebase
• Some customizations were done to the configuration (provide details below is so)

The issue:

I use munin's fail2ban plugin to graph the number of IPs that has been blocked per jail. All the plugins run every 5 minutes via cron in the Debian default configuration. The fail2ban plugin is a simple script that runs status to get the list of jails, then status to get the count for each jail.

1. When I switched from iptables to nftables the fail2ban plugin would timeout. The workaround is to increase timeout from the default 60 seconds to 300 seconds in /etc/munin/plugin-conf.d/fail2ban:

[fail2ban]
timeout 300

2. fail2ban-client status is ~43 times slower than getting the data from nft directly:

\# time for jail in apache-noscript dovecot postfix sshd; do fail2ban-client status $jail | grep 'Currently banned'; done
   |- Currently banned: 34
   |- Currently banned: 189
   |- Currently banned: 1415
   |- Currently banned: 7378

real    0m2.161s
user    0m1.803s
sys     0m0.313s

\# time nft list table inet filter -j | jq -r ".nftables[] | select(has(\"set\")).set |  [.name, (.elem | length) ] | \"\(.[0]) \(.[1])\""
f2b-sshd 7378
f2b-apache-noscript 34
f2b-postfix 1415
f2b-dovecot 189

real    0m0.050s
user    0m0.051s
sys     0m0.012s

I shared claim 1 with you mainly for context, as a way to document the workaround, and in case it helps troubleshoot. What I am asking is to see if there is a way to speed up 2, say, from 43x to <10x slower. There is a lot value in fail2ban-client status abstracting away the backend (iptables vs nftables) so I do think it's worth looking into.

Steps to reproduce

Expected behavior

Observed behavior

Any additional information

Configuration, dump and another helpful excerpts

Any customizations done to /etc/fail2ban/ configuration

Relevant parts of /var/log/fail2ban.log file:

Relevant lines from monitored log files in question: