SF.net SVN: logwatch:[314] trunk/scripts/services/sshd

Revision: 314
          http://sourceforge.net/p/logwatch/code/314
Author:   bjorn1
Date:     2016-02-11 21:57:54 +0000 (Thu, 11 Feb 2016)
Log Message:
-----------
Filtering messages when in verbose mode, and added ssh key method to output.

Modified Paths:
--------------
    trunk/scripts/services/sshd

Modified: trunk/scripts/services/sshd
===================================================================
--- trunk/scripts/services/sshd	2016-02-11 21:54:41 UTC (rev 313)
+++ trunk/scripts/services/sshd	2016-02-11 21:57:54 UTC (rev 314)
@@ -293,15 +293,19 @@
        ($ThisLine =~ /^Failed keyboard-interactive for <invalid username> from/ ) or
        ($ThisLine =~ /^Keyboard-interactive \(PAM\) userauth failed/ ) or
        ($ThisLine =~ /^debug1: /) or
+       ($ThisLine =~ /Set \/proc\/self\/oom_(score_)?adj (from -?\d )?to -?\d/ ) or
+       ($ThisLine =~ /Starting session: (forced-command|subsystem|shell|command)/ ) or
+       ($ThisLine =~ /Found matching \w+ key:/ ) or
+       ($ThisLine =~ /User child is on pid \d/ ) or
        ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/)
    ) {
       # Ignore these
-   } elsif ( my ($Method,$User,$Host,$Port) = ($ThisLine =~ /^Accepted (\S+) for (\S+) from ([\d\.:a-f]+) port (\d+)/) ) {
+   } elsif ( my ($Method,$User,$Host,$Port,$Key) = ($ThisLine =~ /^Accepted (\S+) for ((?:invalid user )?\S+) from ([\d\.:a-f]+) port (\d+) ssh[12](?:: (\w+))?/) ) {
       if ($Debug >= 5) {
-         print STDERR "DEBUG: Found -$User logged in from $Host using $Method\n";
+         print STDERR "DEBUG: Found -$User logged in from $Host using $Method ($Key)\n";
       }
       if ($Detail >= 20) {
-         $Users{$User}{$Host}{$Method}++;
+         $Users{$User}{$Host}{$Method . ($Key ? " ($Key)" : "")}++;
       } else {
          if ( $Host !~ /$IgnoreHost/ ) {
             $Users{$User}{$Host}{"(all)"}++;

This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.


------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140