Troubleshooting

Nothing is being banned

Work down this list; each step is offline or harmless.

1. Is the filter matching at all?

minsec test sshd /var/log/secure

No output means the pattern never matched. Either the log genuinely has no failures, or your service logs in a format the built-in pattern does not cover — compare a real failure line against minsec-filter.toml(5) and override the filter's patterns.

2. Is minsec reading the right source?

minsec inspect

This shows which files and journal identifiers each enabled filter is actually watching. A filter configured for /var/log/auth.log on an EL system (where the file is /var/log/secure) reads nothing and reports no error, because an absent file is a normal state — it may appear at the next rotation.

3. Is the threshold being reached?

maxretry failures must land inside findtime. Three failures an hour apart never trigger a default configuration. Lower maxretry or widen findtime for the filter.

4. Is the address allowlisted?

minsec inspect | grep -A5 allow

Loopback and local addresses are always implied. Your own address may be too.

5. Is the daemon running with a real backend?

minsec status

If backend is null, the engine is running and deciding correctly — it is just not writing to the firewall. That is the dry-run mode.

Bans exist but traffic still arrives

Check the kernel, not the daemon:

sudo nft list set inet minsec ban4

If the address is in the set and packets still get through, something ahead of priority -10 is accepting them first, or the traffic is arriving on a path the input/forward chains do not see (a container's own netns, for example). minsec does not modify other firewalls' rules by design — see firewall.

minsec check fails after an edit

That is the check doing its job. It compiles every enabled filter offline, so a bad regex or an unknown key fails here rather than at the next restart. The daemon does not live-reload; run check before restart, always.

The service will not start

systemctl status minsec
journalctl -u minsec -n 50 --no-pager

The most common causes are a configuration error (minsec check will say so), a missing /run/minsec (systemd-tmpfiles --create after a source install), or no nftables support in the kernel — try --backend null to confirm the engine itself is fine.

Multiplayer mode is not pulling anything

minsec-sync status

This reports enrollment state, the events-log cursor, and the feed cursors. A fresh enrollment solves a proof-of-work, which takes a few seconds of one core; until it completes there is no host_id and nothing is pulled. See multiplayer mode.

Still stuck

Open an issue at the minsec repository with the output of minsec inspect --json and minsec status --json. Neither contains log content, usernames or traffic — see privacy for exactly what they do contain.