#130 Issue with ignore.conf lines for exim

[Stamgastje]

I have many lines in the log indicating that "The TLS connection was non-properly terminated."

Examples from /var/log/exim4/mainlog:

# 2026-08-09 07:31:27 TLS error on connection from (7se3rjd91m09u7yuv0d2ss) [122.187.230.41] (recv): The TLS connection was non-properly terminated.
# 2026-08-09 07:47:56 TLS error on connection from [208.69.161.214] (gnutls_handshake): The TLS connection was non-properly terminated.
# 2026-08-09 09:29:06 TLS error on connection from maile-ac.linkedin.com [108.174.3.195] (recv): The TLS connection was non-properly terminated.

The logwatch output I get is as follows:

 --- TLS Connection Issues 
   ...
    gnutls_handshake: The TLS connection was non-properly terminated: 1 Time(s)
   recv: The TLS connection was non-properly terminated: 4 Time(s)
   ...

  From these hosts:
   ...
   mailb-hf.linkedin.com: 1 Time(s)
   maile-ad.linkedin.com: 1 Time(s)
   maile-bb.linkedin.com: 1 Time(s)
   maile-df.linkedin.com: 1 Time(s)
   maile-ge.linkedin.com: 1 Time(s)
   maile-hc.linkedin.com: 1 Time(s)
   maile-hf.linkedin.com: 1 Time(s)
   ...

The reason why exim throws these warnings seems to be that some servers intentionally omit TLS close_notify on connection close to save a roundtrip, despite it being against the TLS protocol. See: https://github.com/Exim/exim/pull/94. Hence, hey are basically false positives / noise.

To suppress those warnings, I've added the following regular expression in my ignore.conf file:

.+: The TLS connection was non-properly terminated.

This only partially works; I do no longer such these lines lines in the output:

   gnutls_handshake: The TLS connection was non-properly terminated: 1 Time(s)
   recv: The TLS connection was non-properly terminated: 4 Time(s)

However, I still see the following output:

 --- TLS Connection Issues 
   ...

  From these hosts:
   ...
   mailb-hf.linkedin.com: 1 Time(s)
   maile-ad.linkedin.com: 1 Time(s)
   maile-bb.linkedin.com: 1 Time(s)
   maile-df.linkedin.com: 1 Time(s)
   maile-ge.linkedin.com: 1 Time(s)
   maile-hc.linkedin.com: 1 Time(s)
   maile-hf.linkedin.com: 1 Time(s)
   ...

And I've checked my exim logs and these hosts are only producing those warnings (and not also other warnings). Hence, it seems that only suppresses the warning lines, but still lists the hosts in those lines.

Am I doing something wrong? Or is this a bug in logwatch?

[Bjorn]

New exim script pushed to repository; let us know if it fixes it. As per the link you provided, openssl reports it depending on its version. For this script, I've pushed it to only print if Detail is above 50, as is already the case for other log statements in this script.

[Stamgastje]

That indeed fixes it. Thanks!