It does work, like 5 times out of 3000 or so.
Running on Debian installed with apt-get and added only following jail.local file
cat jail.local
[ssh]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 6
bantime = 43200
When I run fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf
I get: Success, the total number of match is 9964
However my logwatch says that only 5 bans happened.
Logwatch file:
##################################################################
--------------------- fail2ban-messages Begin ------------------------
Banned services with Fail2Ban: Bans:Unbans
ssh: [ 5:5 ]
---------------------- fail2ban-messages End -------------------------
--------------------- pam_unix Begin ------------------------
sshd:
Authentication Failures:
root (219.254.35.83): 1606 Time(s)
root (60.12.251.5): 594 Time(s)
root (174.121.45.9): 314 Time(s)
root (61.29.147.194): 222 Time(s)
unknown (60.12.251.5): 146 Time(s)
unknown (61.29.147.194): 84 Time(s)
bin (60.12.251.5): 22 Time(s)
backup (61.29.147.194): 8 Time(s)
mysql (61.29.147.194): 4 Time(s)
backup (60.12.251.5): 2 Time(s)
news (60.12.251.5): 2 Time(s)
mysql (60.12.251.5): 1 Time(s)
unknown (59.175.218.166): 1 Time(s)
Invalid Users:
Unknown Account: 231 Time(s)