Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 139606 - New sshd logs not processed correctly
Summary: New sshd logs not processed correctly
Alias: None
Product: Fedora
Classification: Fedora
Component: logwatch
Version: 3
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Ivana Varekova
QA Contact:
Depends On:
Blocks: 227805
TreeView+ depends on / blocked
Reported: 2004-11-16 21:46 UTC by Alan Hamilton
Modified: 2007-11-30 22:10 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2005-06-24 11:12:54 UTC

Attachments (Terms of Use)

Description Alan Hamilton 2004-11-16 21:46:11 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3)
Gecko/20040913 Firefox/0.10.1

Description of problem:
FC3 uses openssh-3.9p1-7.  The logs are in a slightly different
format, so some messages are lumped into **Unmatched Entries**

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.  Run logwatch against openssh-3.9p1-7 that contains Invalid user
and Failed password lines

Actual Results:
   **Unmatched Entries**
Invalid user test from ::ffff:
Failed password for invalid user test from ::ffff: port
33205 ssh2
Invalid user guest from ::ffff:
Failed password for invalid user guest from ::ffff: port
33490 ssh2

Expected Results:
Illegal users from these:
   test/password from ::ffff: 1 Time(s)
   guest/password from ::ffff: 1 Time(s)

Failed logins from these:
   test/password from ::ffff: 1 Time(s)
   guest/password from ::ffff: 1 Time(s)

Comment 1 David Keegel 2005-05-21 00:46:29 UTC
It looks like this should be fixed in logwatch 6.0.1 shipped with FC4 test3.
(I have the same problem with FC3, and get logs of unmatched entries.)

Comment 2 Ivana Varekova 2005-06-24 11:12:54 UTC
This problem is fixed in the current release.

Note You need to log in before you can comment on or make changes to this bug.