I can confirm this behaviour is still buggy in version 0.9.6-2 (current debian stretch repo). So far I have switched to systemd backends for sshd and postfix on my machine, and I had to make the following changes:
replace journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd with journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd in /etc/fail2ban/filter.d/sshd.conf /etc/fail2ban/filter.d/sshd-ddos.conf and replace journalmatch = _SYSTEMD_UNIT=postfix.service with journalmatch = [email protected] in /etc/fail2ban/filter.d/postfix.conf /etc/fail2ban/filter.d/postfix-sasl.conf HTH, Vincent
