Dear Maintainer,


   * What led up to the situation?
I noticed the issue after the trixie update, however it may have been in the bookworm version also already, without me noticing it.


   * What exactly did you do (or not do) that was effective (or
     ineffective)?
When you add a banned IP to the recidive jail, the IP is added, and an error is logged to fail2ban.log. This also happens when the banned IPs are re-added to the recidive jail when fail2ban is started.

The error is:

2025-08-12 23:20:46,008 fail2ban.actions        [191971]: NOTICE  [recidive] Ban 91.210.179.185
2025-08-12 23:20:46,047 fail2ban.utils          [191971]: ERROR   7fcd1d583360 -- exec: nft add table inet f2b-table
nft -- add chain inet f2b-table f2b-chain \{ type filter hook input priority -1 \; \}
nft add set inet f2b-table addr-set-recidive \{ type ipv4_addr\; \}

nft add rule inet f2b-table f2b-chain meta l4proto \{ all \} ip saddr @addr-set-recidive reject

2025-08-12 23:20:46,047 fail2ban.utils          [191971]: ERROR   7fcd1d583360 -- stderr: 'Error: syntax error, unexpected all'
2025-08-12 23:20:46,047 fail2ban.utils          [191971]: ERROR   7fcd1d583360 -- stderr: 'add rule inet f2b-table f2b-chain meta l4proto { all } ip saddr @addr-set-recidive reject'
2025-08-12 23:20:46,048 fail2ban.utils          [191971]: ERROR   7fcd1d583360 -- stderr: '                                                 ^^^'
2025-08-12 23:20:46,048 fail2ban.utils          [191971]: ERROR   7fcd1d583360 -- returned 1
2025-08-12 23:20:46,048 fail2ban.actions        [191971]: ERROR   Failed to execute ban jail 'recidive' action 'nftables' info 'ActionInfo({'ip': '91.210.179.185', 'family': 'inet4', 'fid': <function Actions.ActionInfo.<lambda> at 0x7fcd1f05e020>, 'raw-ticket': <function Actions.ActionInfo.<lambda> at 0x7fcd1f05e7a0>})': Error starting action Jail('recidive')/nftables: 'Script error'


   * What was the outcome of this action?
Many errors added to the log fail2ban.log. The IPs _are_ added to the jail, it's just that this error is also logged. And because I had about 818 IPs in the recidive jail, that's a lot of errors that are not needed.


   * What outcome did you expect instead?
The error shuold not be logged. I checked the jail with fail2ban-client get recidive banned and the correct IPs are listed, so they seem ot have been re-added correctly.


Thanks for all the awesome work for fail2ban in Debian.

With kind regards, Erik