https://sourceforge.net/p/logwatch/feature-requests/16/
This now trips due to TLS: Connection closed and /Connection closed(?! (auth failed)/ in ignored matches.
Jul 22 23:09:00 host dovecot[168]: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 3 secs): user=user@domain.com, method=PLAIN, rip=118.200.210.77, lip=192.168.1.3, TLS: Connection closed, session=<jxav8xgbotn2ynjn></jxav8xgbotn2ynjn>
I'm unsure how to exclude TLS: prefix from the ignore match. Matching the complete /Disconnected: Connection closed(?! (auth failed)/ seems to work though.
Posting the patch with the missing newline here as well.
Thanks for the patch.