Fail2Ban not logging attemps from Dropbear pt.2

Now I see.
Dropbear doesn’t log to /var/log, it logs directly to systemd. That’s why var/log/auth.log is empty.

So your logpath in your jail.conf is unnecessary, backend=systemd is the right choice, and that is why it’s working.

You can see the logs of dropbear (and thus the login attempts made) with journalctl -u dropbear.service.

Fail2ban itself logs probably to /var/log/fail2ban.log, since it’s not executed as a systemd service.