Re: Script for analyzing sshguard logs?

> -----Original Message-----
> From: Adrian van Bloois <adrian-8dV8o5nDA0NmR6Xm/[email protected]>
> Sent: Friday, November 22, 2019 8:21 AM
> To: [email protected]
> Subject: [Logwatch-devel] Script for analyzing sshguard logs?
> 
> Hi,
> I recently installed sshguard. I would be interested to run a script in
> logwatch to analyze the logging of sshguard.
> Is a script for this available somewhere?

Did you try version 7.5.2?

jpyeron@blackfat /projects/logwatch.master
$ git reset --hard f6b19b9
HEAD is now at f6b19b9 Corrected release date.

jpyeron@blackfat /projects/logwatch.master
$ grep -ri sshguard
scripts/services/secure:%sshguardAttackers = ();
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: Reloading rotated file /) or
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: Session \d+ logged out/) or
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: Exiting on signal/) or
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: Monitoring attacks from /) or
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: (?:message repeated \d+ times: \[ )?\S+: not blocking /) or
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: Received EOF from stdin/) or
scripts/services/secure:      ( $ThisLine =~ /sshguard\[\d+\]: .*has already been blocked/) or
scripts/services/secure:   } elsif ($ThisLine =~ /sshguard\[\d+\]: Blocking (.*) for (.*)/) {
scripts/services/secure:      $sshguardAttackers{$attacker} = $details;
scripts/services/secure:if (keys %sshguardAttackers) {
scripts/services/secure:   print "\nSSHGuard blocked:\n";
scripts/services/secure:   foreach $attacker (sort {$a cmp $b} keys %sshguardAttackers) {
scripts/services/secure:      my $details = $sshguardAttackers{$attacker};


If so, were there specific messages it missed?

v/r,

Jason