Re: [Logwatch] **Unmatched Entries** - v.7.3.5

Michał Panasiewicz wrote:
> Dnia 17-06-2007, N o godzinie 02:13 +0200, Michał Panasiewicz
> napisał(a):
>>> --------------------- SSHD Begin ---------------------
>> ...
>  
"
  : 1 time(s)
> 

This seems to be specific to SSHD Jail setups. I found this

> The message is generated within syslogin_perform_logout() in loginrec.c if the
> call to logout() from libutil (see logout(3)) fails. It fails if it could not
> find a corresponding entry within utmp. This entry is generated by a call to
> login() (see login(3)) during the user logs onto the host before, but login()
> doesn't have any return value, so there's no reasonable way to determine if
> the call succeeded. And this is the problem (was it on my host). Login()
> makes entries into utmp by grabbing the name of the tty by a call to
> ttyslot() (see ttyslot(3)) and ttyslot() needs the file /etc/ttys to work
> properly.
> 
> So what to do now to correct set up your jail on your system:
> 1) Make sure (touch) that the following files exist:
> /var/log/wtmp
> /var/log/lastlog
> /var/run/utmp
> 
> 2) Make sure that the file /etc/ttys (see ttys(5)) exists!!! (That was the
> problem on my system).
> 
> 3) Additionally you might place an additional log socket into your jail by
> specifying the option -l <sock> to your syslogd. 


I'm going not doing anything about this since it is a valid error 
message and probably should be fixed. End users who do not want to fix 
it should add the

syslogin_perform_logout: logout() returned an error to the Ignore.conf file.

-Mike