|
 |
25f594 |
Resolves: #1317620
|
|
|
25f594 |
|
|
|
25f594 |
--- logwatch-7.4.3/scripts/services/sshd 2017-08-29 09:16:47.087028191 +0200
|
|
|
25f594 |
+++ logwatch-7.4.3-new/scripts/services/sshd 2017-08-29 09:19:37.372081596 +0200
|
|
|
25f594 |
@@ -297,7 +297,9 @@ while (defined(my $ThisLine = <STDIN>))
|
|
|
25f594 |
($ThisLine =~ /Starting session: (forced-command|subsystem|shell|command)/ ) or
|
|
|
25f594 |
($ThisLine =~ /Found matching \w+ key:/ ) or
|
|
|
25f594 |
($ThisLine =~ /User child is on pid \d/ ) or
|
|
|
25f594 |
- ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/)
|
|
|
25f594 |
+ ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/) or
|
|
|
25f594 |
+ ($ThisLine =~ /Exiting on signal .*$/) or
|
|
|
25f594 |
+ ($ThisLine =~ /Disconnected from (?:[^ ]*) port .*$/)
|
|
|
25f594 |
) {
|
|
|
25f594 |
# Ignore these
|
|
|
25f594 |
} elsif ( my ($Method,$User,$Host,$Port,$Key) = ($ThisLine =~ /^Accepted (\S+) for ((?:invalid user )?\S+) from ([\d\.:a-f]+) port (\d+) ssh[12](?:: (\w+))?/) ) {
|
|
|
25f594 |
@@ -387,7 +389,9 @@ while (defined(my $ThisLine = <STDIN>))
|
|
|
25f594 |
$RefusedConnections{$1}++;
|
|
|
25f594 |
} elsif ( my ($Reason) = ($ThisLine =~ /^Authentication refused: (.*)$/ ) ) {
|
|
|
25f594 |
$RefusedAuthentication{$Reason}++;
|
|
|
25f594 |
- } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*) port [^ ]*: (.*)$/)) {
|
|
|
25f594 |
+ # Old format: Received disconnect from 192.168.122.1: 11: disconnected by user
|
|
|
25f594 |
+ # New format: Received disconnect from 192.168.122.1 port 43680:11: disconnected by user
|
|
|
25f594 |
+ } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*)(?: port \d+)?: ?(.*)$/)) {
|
|
|
25f594 |
# Reason 11 (SSH_DISCONNECT_BY_APPLICATION) is expected, and logged at severity level INFO
|
|
|
25f594 |
if ($Reason != 11) {$DisconnectReceived{$Reason}{$Host}++;}
|
|
|
25f594 |
} elsif ( my ($Host) = ($ThisLine =~ /^ROOT LOGIN REFUSED FROM ([^ ]*)$/)) {
|