#130 Issue with ignore.conf lines for exim

[Stamgastje]

I have many lines in the log indicating that "The TLS connection was non-properly terminated."

Examples from /var/log/exim4/mainlog:

# 2026-08-09 07:31:27 TLS error on connection from (7se3rjd91m09u7yuv0d2ss) [122.187.230.41] (recv): The TLS connection was non-properly terminated.
# 2026-08-09 07:47:56 TLS error on connection from [208.69.161.214] (gnutls_handshake): The TLS connection was non-properly terminated.
# 2026-08-09 09:29:06 TLS error on connection from maile-ac.linkedin.com [108.174.3.195] (recv): The TLS connection was non-properly terminated.

The logwatch output I get is as follows:

 --- TLS Connection Issues 
   ...
    gnutls_handshake: The TLS connection was non-properly terminated: 1 Time(s)
   recv: The TLS connection was non-properly terminated: 4 Time(s)
   ...

  From these hosts:
   ...
   mailb-hf.linkedin.com: 1 Time(s)
   maile-ad.linkedin.com: 1 Time(s)
   maile-bb.linkedin.com: 1 Time(s)
   maile-df.linkedin.com: 1 Time(s)
   maile-ge.linkedin.com: 1 Time(s)
   maile-hc.linkedin.com: 1 Time(s)
   maile-hf.linkedin.com: 1 Time(s)
   ...

The reason why exim throws these warnings seems to be that some servers intentionally omit TLS close_notify on connection close to save a roundtrip, despite it being against the TLS protocol. See: https://github.com/Exim/exim/pull/94. Hence, hey are basically false positives / noise.

To suppress those warnings, I've added the following regular expression in my ignore.conf file:

.+: The TLS connection was non-properly terminated.

This only partially works; I do no longer such these lines lines in the output:

   gnutls_handshake: The TLS connection was non-properly terminated: 1 Time(s)
   recv: The TLS connection was non-properly terminated: 4 Time(s)

However, I still see the following output:

 --- TLS Connection Issues 
   ...

  From these hosts:
   ...
   mailb-hf.linkedin.com: 1 Time(s)
   maile-ad.linkedin.com: 1 Time(s)
   maile-bb.linkedin.com: 1 Time(s)
   maile-df.linkedin.com: 1 Time(s)
   maile-ge.linkedin.com: 1 Time(s)
   maile-hc.linkedin.com: 1 Time(s)
   maile-hf.linkedin.com: 1 Time(s)
   ...

And I've checked my exim logs and these hosts are only producing those warnings (and not also other warnings). Hence, it seems that only suppresses the warning lines, but still lists the hosts in those lines.

Am I doing something wrong? Or is this a bug in logwatch?