Package: crowdsec Version: all Severity: critical In the latest openssh-server package (testing & unstable), "sshd-session" is used for many log messages, which breaks crowdsec/hub/parsers/s01-parse/crowdsecurity/sshd-logs.yaml
filter: "evt.Parsed.program == 'sshd'" As to the above snippet, the filter is explicitly set to use "sshd" only. Crowdsec silently stops working after new openssh-server package is installed. In my case, I found out the issue weeks later. This affects all crowdsec versions, including 1.4.6-9+b1 and previous 1.4.6-8.