Fail2ban fails to ban (dos attack)

Question

I want to use fail2ban for protecting my server. The http server is a script node that I succeded at formatting the logs like following:

2017-03-18 18:03:32.940 [ INFO ] - ::ffff:192.168.1.56 GET /

The interesting part of jail.conf is:

[node-get-dos]
enabled = true
port = 8080 
filter = node-get-dos
logpath = /logs/selector.log
maxretry = 10
findtime = 10
bantime = 600

and the content of node-get-dos is:

[Definition]
failregex = \[.*\].*:.?:.*:<HOST>.*\ (GET|POST|DELETE).*
ignoreregex =

So when I launch the following command, I don't get banned:

ab -n 1000 -c 100 http://192.168.1.3:8080/

And I Don't know if it's important, but the node script is in a docker container.

I've already a solution which is to put the node behind a reverse proxy (apache) and to configure fail2ban to analyse the logs of apache (access.log) but I want to avoid that (consumes more cpu and RAM).

EDIT: Here's an example after a reboot and launching the ab command:

2017-03-18 19:25:52,296 fail2ban.server         [15690]: INFO    Exiting Fail2ban
2017-03-18 19:25:52,584 fail2ban.server         [21170]: INFO    Changed logging target to /var/log/fail2ban.log for Fail2ban v0.9.3
2017-03-18 19:25:52,586 fail2ban.database       [21170]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2017-03-18 19:25:52,591 fail2ban.jail           [21170]: INFO    Creating new jail 'sshd'
2017-03-18 19:25:52,606 fail2ban.jail           [21170]: INFO    Jail 'sshd' uses pyinotify
2017-03-18 19:25:52,617 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,622 fail2ban.jail           [21170]: INFO    Initiated 'pyinotify' backend
2017-03-18 19:25:52,626 fail2ban.filter         [21170]: INFO    Set maxRetry = 3
2017-03-18 19:25:52,627 fail2ban.actions        [21170]: INFO    Set banTime = 900
2017-03-18 19:25:52,630 fail2ban.filter         [21170]: INFO    Added logfile = /var/log/auth.log
2017-03-18 19:25:52,633 fail2ban.filter         [21170]: INFO    Set findtime = 600
2017-03-18 19:25:52,633 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,634 fail2ban.filter         [21170]: INFO    Set maxlines = 10
2017-03-18 19:25:52,691 fail2ban.server         [21170]: INFO    Jail sshd is not a JournalFilter instance
2017-03-18 19:25:52,695 fail2ban.jail           [21170]: INFO    Creating new jail 'node-get-dos'
2017-03-18 19:25:52,695 fail2ban.jail           [21170]: INFO    Jail 'node-get-dos' uses pyinotify
2017-03-18 19:25:52,696 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,699 fail2ban.jail           [21170]: INFO    Initiated 'pyinotify' backend
2017-03-18 19:25:52,703 fail2ban.filter         [21170]: INFO    Set maxRetry = 10
2017-03-18 19:25:52,703 fail2ban.actions        [21170]: INFO    Set banTime = 600
2017-03-18 19:25:52,706 fail2ban.filter         [21170]: INFO    Added logfile = /logs/selector.log
2017-03-18 19:25:52,710 fail2ban.filter         [21170]: INFO    Set findtime = 10
2017-03-18 19:25:52,710 fail2ban.filter         [21170]: INFO    Set jail log file encoding to UTF-8
2017-03-18 19:25:52,718 fail2ban.jail           [21170]: INFO    Jail 'sshd' started
2017-03-18 19:25:52,724 fail2ban.jail           [21170]: INFO    Jail 'node-get-dos' started

Answer 1

The fail2ban-regex utility says that your regex is good and it matches the log you have provided

Lines: 1 lines, 0 ignored, 1 matched, 0 missed

so you need to look elsewhere. You should check the fail2ban log messages from fail2ban's startup, to ensure that for example it can read the log file. I have no idea where you'll find them in the frankenstack you have.