Re: Excess sshd unmatched entries

Can you provide a sample of the Unmatched Entries?  Make sure the syntax
is preserved if you want to obscure identifying information.


On 7/27/19 10:12 AM, Glenn Talbott wrote:
> Logwatch People,
> =

> =A0
> =

> FYI:
> =

> =A0
> =

> # Ubuntu 18.04.02 LTS (i386) OpenSSH_7.6p1 Ubuntu-4ubuntu0.3, OpenSSL
> 1.0.2n=A0 7 Dec 2017:
> =

> # Logwatch 7.4.3 (released 12/07/16):
> =

> # I recently changed my router firewall config to forward TCP/UDP:22 to
> <this PC> for SSH server so I can get a shell prompt when not at home.
> =

> # A side effect of this change generates literally thousands of
> "Unmatched Entries" in Logwatch from many IP addresses as bad guys try
> to break into ssh.
> =

> # My workaround is to comment out the following if statement in
> /etc/logwatch/scripts/services/sshd (copied from
> /usr/share/logwatch/scripts/services/sshd).
> =

> # =A0Is there a better way to fix this? gtalbott-/1bC63wxbnDD0D/[email protected] July 2019
> =

> # ----------------
> =

> #if (keys %OtherList) {
> =

> #=A0=A0 print "\n**Unmatched Entries**\n";
> =

> #=A0=A0 print "$_ : $OtherList{$_} time(s)\n" foreach keys %OtherList;
> =

> #}
> =

> # ----------------
> =

> =A0
> =

> Is there a better way to fix this?
> =

> =A0
> =

> Regards,
> =

> =A0
> =

> Glenn Talbott
> =

> gtalbott-/1bC63wxbnDD0D/[email protected] <mailto:gtalbott-/1bC63wxbnDD0D/[email protected]>
> =

> =A0
> =

> P.S. There must be a better category name than =93Unmatched Entries=94 for
> log entries that are not explicitly called out in the script. Before I
> dug into the scripts I always thought that =93Unmatched Entries=94 referr=
ed
> to some kind of process that was logged as started but had no matching
> completion entry in the log. =93Unmatched Entries=94 as you used it is
> internal to the script and in that context makes perfect sense to the
> script authors, but it =A0has no meaning to someone externally reading the
> output from Logwatch and knowing nothing of the structure of the scripts.
> =

> =A0
> =

> My 2 cents worth.
> =

> =A0
> =

> GT
> =

> =

> =

> _______________________________________________
> Logwatch-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/logwatch-devel
> =