Fail2ban not detecting Nextcloud logs

[BobsYourUncle1]

I installed Nexcloud using the Docker AIO (not with a reverse proxy or behind a web server). I have attempted to configure Fail2ban based on the Nextcloud documentation. I tested the system by attempting to login with the incorrect password multiple times in a row. The failed login attempts are getting logged in the Nextcloud web UI, but no failed logins are detected by Fail2ban. In addition, the nextcloud.log file is empty. My Fail2ban files are below.

nextcloud.local:
[nextcloud]
backend = auto
enabled = true
port = 80,443
protocol = tcp
filter = nextcloud
maxretry = 3
bantime = 86400
findtime = 43200
logpath = /var/lib/docker/volumes/nextcloud_aio_nextcloud_data/_data/nextcloud.log
chain = DOCKER-USER

nextcloud.conf:
[Definition]
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+)))
failregex = ^{%(_groupsre)s,?\s"remoteAddr":""%(_groupsre)s,?\s*"message":"Login failed:
^{%(_groupsre)s,?\s*"remoteAddr":""%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
^{%(_groupsre)s,?\s*"remoteAddr":""%(_groupsre)s,?\s*"message":"Trusted domain error.
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"

I may be overlooking something very simple, but I have verified the correct logpath and other file locations. Any help with this would be greatly appreciated.

[szaimen]

Hi, please compare your config with the official docs: https://github.com/nextcloud/all-in-one#fail2ban

[BobsYourUncle1]

Thank you for your response and reference to the official docs. There must have been a copy/paste error with the nexcloud.conf file that I initially posted and the accurate file is below (there may still be a copy/paste error but the syntax of the file is correct on my system). I can't find any inaccuracies between these files and what is recommended in the documentation. I have also added 'logfilemode' => 0644, to the config.php file within the docker container and the loglevel is set to 2. Still, there are no logs in the nextcloud.log file on the host. After I attempt to login multiple times with the incorrect password, running fail2ban-client status nextcloud results in:
Status for the jail: nextcloud
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| - File list: /var/lib/docker/volumes/nextcloud_aio_nextcloud_data/_data/nextcloud.log - Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:

If I have missed any additional details in the documentation I apologize. I am somewhat of a novice so any help on next steps is greatly appreciated.

/etc/fail2ban/jail.d/nextcloud.local
[nextcloud]
backend = auto
enabled = true
port = 80,443
protocol = tcp
filter = nextcloud
maxretry = 3
bantime = 86400
findtime = 43200
logpath = /var/lib/docker/volumes/nextcloud_aio_nextcloud_data/_data/nextcloud.log
chain = DOCKER-USER

/etc/fail2ban/filter.d/nextcloud.conf
[Definition]
_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+)))
failregex = ^{%(_groupsre)s,?\s"remoteAddr":""%(_groupsre)s,?\s*"message":"Login failed:
^{%(_groupsre)s,?\s*"remoteAddr":""%(_groupsre)s,?\s*"message":"Two-factor challenge failed:
^{%(_groupsre)s,?\s*"remoteAddr":""%(_groupsre)s,?\s*"message":"Trusted domain error.
datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"

[szaimen]

My hint: Please compare the path to the log file with the docs 😉

[szaimen]

Also you should probably add some more ports to the config...

[szaimen]

You could alternatively use the fail2ban community container that is linked there which will make it work without any manual intervention...

[BobsYourUncle1]

I got it working, thank you! I found the error in the logpath, fixed it and that's all it took. I had previously added 8443 to the nextcloud.local file and should have mentioned that initially. Thank you for walking me through this beginner mistake.