Skibbi

I'm back with more questions - recently I updated logwatch in my debian (forky) to 7.13. My sshd.conf is following: Logfile = Logfile = none *JournalCtl = "_SYSTEMD_UNIT=ssh.service -o short-iso" But it seems logwatch cannot parse the date from journalctl :( **Unmatched Entries** 2025-11-10T17:57:07+01:00 gw-02 sshd-session[68506]: Accepted publickey for debian from 192.168.5.45 port 46214 ssh2: ED25519 SHA256:<redacted> : 1 Time The only solution that I found working is to set: *JournalCtl = "_SYSTEMD_UNIT=ssh.service...

I'm back with more questions - recently I updated logwatch in my debian (forky) to 7.13. My sshd.conf is following: Logfile = Logfile = none *JournalCtl = "_SYSTEMD_UNIT=ssh.service -o short-iso" But it seems logwatch cannot parse the date from journalctl :( **Unmatched Entries** 2025-11-10T17:57:07+01:00 gw-02 sshd-session[68506]: Accepted publickey for debian from 192.168.5.45 port 46214 ssh2: ED25519 SHA256:<redacted> : 1 Time The only solution that I found working is to set: *JournalCtl = "_SYSTEMD_UNIT=ssh.service...

To complicate it even more: I use debian testing 13 (trixie) and few weeks ago open-ssh was updated and it changed how sshd logs messages. sshd(8): several log messages have changed. In particular, some log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd". I would appreciate any hints how to make logwatch compatible with this version. Currently I get only: **Unmatched Entries** Sep 11 00:06:13 gw-02 sshd-session[12978]: Connection closed by authenticating...

Ok, that makes sense. I've updated my config and it is working again.

I just downgraded logwatch to 7.5.6-1 and the summary is there: logwatch --service fail2ban ################### Logwatch 7.5.6 (07/23/21) #################### Processing Initiated: Fri Jan 6 11:01:53 2023 Date Range Processed: yesterday ( 2023-Jan-05 ) Period is day. Detail Level of Output: 0 Type of Output/Format: stdout / text Logfiles for Host: xxxxxx ################################################################## --------------------- fail2ban-messages Begin ------------------------ Banned...

fail2ban report missing in summary

Thanks UhClem for the workaround tip. I renamed the files and SnapRaid was able to restore them.

Thanks @UhClem for the workaround tip. I renamed the files and SnapRaid was able to restore them.