This was fixed in cosmic in 7.4.3+git20161207-2ubuntu2. The bug didn't auto-close because the bug number wasn't correctly mentioned in the changelog of the package (it missed a "#").
I added tasks for xenial and bionic. ** Also affects: logwatch (Ubuntu Bionic) Importance: Undecided Status: New ** Also affects: logwatch (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: logwatch (Ubuntu) Status: In Progress => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1644057 Title: Excessive Disconnect unmatched entries from sshd Status in logwatch package in Ubuntu: Fix Released Status in logwatch source package in Xenial: New Status in logwatch source package in Bionic: New Status in logwatch package in Debian: New Bug description: [Impact] User ssh disconnect messages in syslog aren't handled by logwatch, and thus end up in the "Unmatched Entries" section, one per event. This clutters up the logwatch reports unnecessarily. [Test Case] # lxc launch ubuntu-daily:cosmic tester # lxc exec tester bash # apt update # apt dist-upgrade -y # apt install -y logwatch openssh-server mailutils * mail configuration : Local only * System mail name: (use default) # sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config # systemctl restart sshd # passwd ubuntu * choose a password # ssh ubuntu@localhost * login, then exit # logwatch --detail Med --mailto root --service all --range today # sleep 1 # mail * select message 1 * Search for SSHD: /SSHD You will see unmatched entries: **Unmatched Entries** Disconnected from user ubuntu 127.0.0.1 port 53084 : 1 time(s) [Original Description] # lsb_release -rd Description: Ubuntu 16.04.1 LTS Release: 16.04 # apt-cache policy logwatch logwatch: Installed: 7.4.2-1ubuntu1 Candidate: 7.4.2-1ubuntu1 Version table: *** 7.4.2-1ubuntu1 500 500 http://mirrors.digitalocean.com/ubuntu xenial/main amd64 Packages 500 http://mirrors.digitalocean.com/ubuntu xenial/main i386 Packages 100 /var/lib/dpkg/status The issue seems to be exactly as described here: https://bugzilla.redhat.com/show_bug.cgi?id=1317620 In synopsis, Logwatch's "SSHD" output contains excessive "Unmatched Entries" regarding SSH disconnections. They look like this: Received disconnect from 123.123.123.123 port 6887:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 8310:11: disconnected by user : 1 time(s) Disconnected from 123.123.123.123 port 1306 : 1 time(s) Received disconnect from 123.123.123.123 port 3720:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 3001:11: disconnected by user : 1 time(s) Disconnected from 123.123.123.123 port 1054 : 1 time(s) Received disconnect from 123.123.123.123 port 9741:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 3261:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 4650:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 13235:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 1065:11: disconnected by user : 1 time(s) Received disconnect from 123.123.123.123 port 13868:11: disconnected by user : 1 time(s) Disconnected from 123.123.123.123 port 8542 : 1 time(s) I should mention that these connections are from me, and are legitimate; they are not from "bots" or other types of probes/scans that are, for example, check for the availability of vulnerable ciphers. The key finding from the above report seems to be: "I don't know why there are two different format disconnect messages, but the bit that seems to confuse logwatch was adding the port number to the message." There seem to be several (3-5) such messages that result from a normal connect/disconnect cycle. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1644057/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp