Re: [PATCH v2] sshd: fix unmatched entries because of the output change in openssh-7.2p2

Orion Poplawski <[email protected]> Wed, 27 Apr 2016 15:05:29 -0600
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]>
On 03/17/2016 02:51 AM, [email protected] wrote:
> From: Jan Synacek <[email protected]>
> 
> ---
>  scripts/services/sshd | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/scripts/services/sshd b/scripts/services/sshd
> index e238863..a7edb41 100755
> --- a/scripts/services/sshd
> +++ b/scripts/services/sshd
> @@ -387,7 +387,7 @@ while (defined(my $ThisLine = <STDIN>)) {
>        $RefusedConnections{$1}++;
>     } elsif ( my ($Reason) = ($ThisLine =~ /^Authentication refused: (.*)$/ ) ) {
>        $RefusedAuthentication{$Reason}++;
> -   } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*): (.*)$/)) {
> +   } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*)(?: port [^ ]*)?: (.*)$/)) {
>        # Reason 11 (SSH_DISCONNECT_BY_APPLICATION) is expected, and logged at severity level INFO
>        if ($Reason != 11) {$DisconnectReceived{$Reason}{$Host}++;}
>     } elsif ( my ($Host) = ($ThisLine =~ /^ROOT LOGIN REFUSED FROM ([^ ]*)$/)) {
> 

Applied.

-- 
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       [email protected]
Boulder, CO 80301                   http://www.nwra.com

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z