OpenSSH log format change in RHEL 7.4 results in many unmatched output lines in logwatch

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux (RHEL) 7.4
  • logwatch-7.4.0-32.20130522svn140.el7
  • openssh-server-7.4p1-12.el7_4

Issue

With RHEL 7.4 OpenSSH was updated and we experience many logwatch unmatched examples:

Disconnected from x.x.x.x port yyy : 1 time(s)
Disconnected from x.x.x.x  port yyy [preauth] : 1 time(s)
Received disconnect from x.x.x.x port yyy:11: disconnected by user : 1 time(s)
error: maximum authentication attempts exceeded for invalid user test from x.x.x.x port yyy ssh2 [preauth] : 1 time(s)
Received disconnect from x.x.x.x port yyy:11: disconnected by user [preauth] : 1 time(s)
Received disconnect from x.x.x.x port yyy:11:  [preauth] : 1 time(s)
Received disconnect from x.x.x.x port yyy:11: Bye Bye [preauth] : 1 time(s)
error: Received disconnect from x.x.x.x port yyy:3: com.zzz.zzException: Auth fail [preauth] : 1 time(s)

Resolution

Update to logwatch-7.4.0-35.20130522svn140.el7_5 shipped with Advisory RHBA-2018:2445 or newer.

Root Cause

Previously logwatch didn't reflect all the OpenSSH log format changes.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments