This is not correct. :-) Fail2ban needs to somehow get those messages from journald. Did you try disabling it for a boot? When you update today, maybe trying to log the clogging of your services (eg. strace) would be a good idea. cheers! mar77i