Fail2ban does not ban any ip-adresses with vsftpd

Fail2ban starts okey. It work with my sshd filter and bans IP-adresses as it should. But with vsftpd it does not register failed logins when I run:

fail2ban-client status vsftpd

I have tried both the auth.log and vsftpd.log. The file path is changed from what I really have for security reasons and are not really /path/to/thelog.log

vsftpd.log:

Status for the jail: vsftpd
|- filter
|  |- File list:    /path/to/vsftpd.log 
|  |- Currently failed: 0
|  `- Total failed: 0
`- action
   |- Currently banned: 0
   |  `- IP list:   
   `- Total banned: 0

auth.log:

Status for the jail: vsftpd
|- filter
|  |- File list:    /path/to/auth.log 
|  |- Currently failed: 0
|  `- Total failed: 0
`- action
   |- Currently banned: 0
   |  `- IP list:   
   `- Total banned: 0

But with fail2ban-regex it catches the failed logins.

vsftpd.log:

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/vsftpd.conf
Use         log file : /path/to/vsftpd.log


Results
=======

Failregex: 16 total
|-  #) [# of hits] regular expression
|   2) [16] ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client "<HOST>"\s*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [806] WEEKDAY MONTH Day Hour:Minute:Second Year
`-

Lines: 806 lines, 0 ignored, 16 matched, 790 missed
Missed line(s): too many to print.  Use --print-all-missed to print all 790 lines

auth.log:

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/vsftpd.conf
Use         log file : /path/to/auth.log


Results
=======

Failregex: 16 total
|-  #) [# of hits] regular expression
|   1) [16] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[ *\d+\.\d+\])?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?vsftpd(?:\(\S+\))?[\]\)]?:?|[\[\(]?vsftpd(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*\(?pam_unix(?:\(\S+\))?\)?:?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [9174] MONTH Day Hour:Minute:Second
`-

Lines: 9174 lines, 0 ignored, 16 matched, 9158 missed
Missed line(s): too many to print.  Use --print-all-missed to print all 9158 lines

I've tested by failing to login with the right password (logging in the wrong password that is :) ) and with fail2ban-regex the number keeps rising but the status for the jail is still 0 and three failed logins do not trigger a ban.

jail.local:

[vsftpd]
enable     = true
filter     = vsftpd
action     = iptables-multiport[name=vsftpd, port="20, 21, 10204, 10205"]
logpath    = /path/to/auth.log
bantime   = 60
maxretry   = 3

bantime 60 sec is only during testing.

Any ideas why it's not working?

vsftpd.log deny log looks like:

Wed Jun 29 14:57:37 2016 [pid 2517] [username] FTP response: Client "::ffff:192.168.0.100", "530 Permission denied."

and the default failregex WHICH isn't working in fail2ban config file located "/etc/fail2ban/filter.d/vsftpd.conf" looks like

failregex = ^%(__prefix_line)s%(__pam_re)s\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^ \[pid \d+\] \[.+\] FAIL LOGIN: Client "<HOST>"\s*$

So you need to change failregex to the following to get it working with vsftpd

failregex = ^%(__prefix_line)s%(__pam_re)s\s+Permission denied; logname=\S* uid=\S* euid=\S* tty=(ftp)? ruser=\S* rhost=<HOST>(?:\s+user=.*)?\s*$
            ^ \[pid \d+\] \[.+\]\s+FTP response: Client "::ffff:<HOST>",\s*"530 Permission denied\."\s*$

Checked on Ubuntu with vsftpd: version 3.0.3

I think you have a typo in your jail.local. It's enabled = true not enable.

You should check your fail2ban.log that contains a line like:

INFO    Jail 'vsftpd' started