Add an 'ignore' line for the HPN patch that we enable on our openssh by default. https://sourceforge.net/tracker/?func=detail&aid=3257504&group_id=312875&atid=1316824 --- logwatch-7.4.2/scripts/services/sshd +++ logwatch-7.4.2/scripts/services/sshd @@ -297,7 +297,8 @@ ($ThisLine =~ /Starting session: (forced-command|subsystem|shell|command)/ ) or ($ThisLine =~ /Found matching \w+ key:/ ) or ($ThisLine =~ /User child is on pid \d/ ) or - ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/) + ($ThisLine =~ /Nasty PTR record .* is set up for [\da-fA-F.:]+, ignoring/) or + ($ThisLine =~ /^SSH: Server;L[Tt]ype: /) ) { # Ignore these } elsif ( my ($Method,$User,$Host,$Port,$Key) = ($ThisLine =~ /^Accepted (\S+) for ((?:invalid user )?\S+) from ([\d\.:a-f]+) port (\d+) ssh[12](?:: (\w+))?/) ) {