SSH/SFTP logging

--===============5505211720478190780==
Content-Type: multipart/alternative; boundary="f403045f7414d1cdc10553335ca5"

--f403045f7414d1cdc10553335ca5
Content-Type: text/plain; charset="UTF-8"

I'm slowly trying to reduce unknown log lines from logwatch output...

This series is fairly short:
https://github.com/jsoref/logwatch-mirror/compare/master...sftp?expand=1
1. Handle SSH socks forwarding when a client requests to connect to a port
that isn't accepting connections.
2. Handle SFTP in general.

Fwiw, I'm currently running logwatch with sshd detail=100 (previously it
was 20).

I'll probably return to 20 with these changes (i.e. I think it's good to
support the parsing and allow users to review, but I personally don't want
to see most of the SFTP output.)

As you can see from my sample output, we have some heavy SFTP users (time
window is roughly 5 weeks).

--f403045f7414d1cdc10553335ca5
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">I&#39;m slowly trying to reduce unknown log lines from lo=
gwatch output...<div dir=3D"auto"><br></div><div dir=3D"auto">This series i=
s fairly short:<div dir=3D"auto"><a href=3D"https://github.com/jsoref/logwa=
tch-mirror/compare/master...sftp?expand=3D1" target=3D"_blank">https://gith=
ub.com/jsoref/<wbr>logwatch-mirror/compare/<wbr>master...sftp?expand=3D1</a=
><div dir=3D"auto">1. Handle SSH socks forwarding when a client requests to=
 connect to a port that isn&#39;t accepting connections.</div><div dir=3D"a=
uto">2. Handle SFTP in general.</div><div dir=3D"auto"><br></div><div dir=
=3D"auto">Fwiw, I&#39;m currently running logwatch with sshd detail=3D100 (=
previously it was 20).</div><div dir=3D"auto"><br></div><div dir=3D"auto">I=
&#39;ll probably return to 20 with these changes (i.e. I think it&#39;s goo=
d to support the parsing and allow users to review, but I personally don&#3=
9;t want to see most of the SFTP output.)</div><div dir=3D"auto"><br></div>=
<div dir=3D"auto">As you can see from my sample output, we have some heavy =
SFTP users (time window is roughly 5 weeks).</div></div></div></div>

--f403045f7414d1cdc10553335ca5--


--===============5505211720478190780==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============5505211720478190780==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Logwatch-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/logwatch-devel

--===============5505211720478190780==--