The SSHD log parser already handles connection resets during read:
(
# ...
($ThisLine =~ m/^error: .*: read: Connection reset by peer/ ) or
# ...
) {
$NetworkErrors++;
} # ...
However, the same error can happen during writes as well, so I get:
**Unmatched Entries**
error: send_error: write: Connection reset by peer : 1 Time
entries in my logwatch reports. The attached patch expands the above regex to match either read or write.
Thanks for the patch.