I have set up fail2ban for Hubzilla's login. You need to enable debug logging at loglevel 'Normal'. Be careful. The size of the log file can grow to several 100 MBs per day.
/etc/fail2ban/jail.local[hubzilla]
enabled = true
findtime = 300
bantime = 900
maxretry = 3
filter = hubzilla
port = http,https
logpath = /path/to/hubzilla.log
logencoding = utf-8
/etc/fail2ban/filter.d/hubzilla.conf[Definition]
failregex= ^.*auth\.php.*failed login attempt.*from IP <HOST>.*$
ignoreregex =
