Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1504979

Summary: Regression: OpenSSH log format changed, zillion unmatched output lines in logwatch
Product: Red Hat Enterprise Linux 7 Reporter: Robert Scheck <redhat-bugzilla>
Component: logwatchAssignee: Jan Synacek <jsynacek>
Status: CLOSED ERRATA QA Contact: Jakub Heger <jheger>
Severity: high Docs Contact:
Priority: urgent    
Version: 7.4CC: alex, apmukher, fkrska, fsumsal, jsynacek, kwalker, robert.scheck, sebastien.andreatta
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1593588 (view as bug list) Environment:
Last Closed: 2018-10-30 11:24:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1549617, 1549689, 1551061, 1593588    
Attachments:
Description Flags
Sample unfiltered messages none

Description Robert Scheck 2017-10-20 21:46:26 UTC 
Description of problem:
With RHEL 7.4, OpenSSH was updated - but unfortunately poorly tested. At
least no logwatch update was performed for the changed OpenSSH log format
finally. Unmatched examples:

 Disconnected from 192.0.2.91 port 39258 : 1 time(s)

 Disconnected from 192.0.2.91 port 59013 [preauth] : 1 time(s)

 Received disconnect from 192.0.2.91 port 44864:11: disconnected by user : 1 time(s)

 error: maximum authentication attempts exceeded for invalid user user7 from 192.0.2.91 port 16136 ssh2 [preauth] : 1 time(s)

 Received disconnect from 192.0.2.91 port 35653:11: disconnected by user [preauth] : 1 time(s)

 Received disconnect from 192.0.2.91 port 59118:11:  [preauth] : 1 time(s)

 Received disconnect from 192.0.2.91 port 36652:11: Bye Bye [preauth] : 1 time(s)

 error: Received disconnect from 192.0.2.91 port 63867:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)

Having zillions of unmatched output lines in logwatch makes it unreadable
and/or renders logwatch effectively unusable for administrators now.

All IPv4 addresses have been obfuscated and replaced by RFC 5737 ones.

Version-Release number of selected component (if applicable):
logwatch-7.4.0-32.20130522svn140.el7.noarch
openssh-server-7.4p1-12.el7_4.x86_64

How reproducible:
Run RHEL 7.4 with OpenSSH and logwatch.

Actual results:
OpenSSH log format changed, zillion unmatched output lines in logwatch

Expected results:
Regular logwatch output, like at RHEL 7.3

Additional info:
There is some overlap with bug #1317620 from Fedora, however the output
at Fedora seems to have less variations? Or was this patched multiple times
at Fedora and I just gathered a single bug report?
Comment 2 Robert Scheck 2017-10-20 21:50:33 UTC 
Cross-filed ticket 01957071 on the Red Hat customer portal.
Comment 3 Jan Synacek 2017-10-23 07:35:50 UTC 
This is a duplicate of bug #1422797. I'm going to keep it open for now, but please, use #1422797 for further comments.
Comment 4 Robert Scheck 2017-10-23 13:00:29 UTC 
Unfortunately, I am not authorized to access bug #1422797.
Comment 5 Sébastien Andreatta 2018-01-11 07:13:03 UTC 
Hi, I'm not allowed either. 
A patch exist in the Fedora package : https://bugzilla.redhat.com/show_bug.cgi?id=1317620 

Could you please open bug #1422797 for viewer ?
Comment 6 Jan Synacek 2018-01-11 07:35:58 UTC 
(In reply to Sébastien Andreatta from comment #5)
> Could you please open bug #1422797 for viewer ?

No, but here's the testing package, which is currently what's prepared for the release: https://jsynacek.fedorapeople.org/logwatch/logwatch-7.4.0-33.20130522svn140.el7.bz1504979.noarch.rpm
Comment 7 Sébastien Andreatta 2018-01-11 07:40:03 UTC 
@Jan Synacek : 

Thanks i will test it .
Comment 8 alex 2018-01-19 10:08:21 UTC 
Hi,

I'm on that logwatch version and I still have zillion entries like:

 Connection reset by 180.97.224.2 port 63285 [preauth] : 1 time(s)
 error: maximum authentication attempts exceeded for root from 42.7.26.60 port 37345 ssh2 [preauth] : 1 time(s)

Cheers,

Álex
Comment 9 Jan Synacek 2018-01-22 07:35:37 UTC 
(In reply to alex from comment #8)
> Hi,
> 
> I'm on that logwatch version and I still have zillion entries like:

By "that version", you mean the package provided in comment 6?
Comment 10 alex 2018-01-22 13:16:41 UTC 
Yup:

$ rpm -qa | grep logw
logwatch-7.4.0-33.20130522svn140.el7.bz1504979.noarch

I am attaching:

# grep -e "Connection reset" -e "maximum authentication" /var/log/secure | gzip >secure_excerpt.log.gz

to simplify testing/debugging- if logwatch parses some other log file, I can do a similar thing for the other file.
Comment 11 alex 2018-01-22 13:17:25 UTC 
Created attachment 1384436 [details]
Sample unfiltered messages
Comment 12 alex 2018-01-26 13:17:57 UTC 
This one's pretty frequent too:

  error: Received disconnect from 103.99.0.192 port 49992:14: No more user authentication methods available. [preauth] : 1 time(s)
Comment 13 Jan Synacek 2018-02-05 12:03:33 UTC 
Let me know if the following package fixes the unmatched entries. My testing was a bit limited.

https://jsynacek.fedorapeople.org/logwatch/logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v2.noarch.rpm
Comment 14 alex 2018-02-07 22:20:45 UTC 
Great!

I still have a few annoying unmatched lines, but with this patch logwatch is down to a manageable size, good enough for me.

You can close the bug if you want.

The unmatched lines (in case you want to "fix" them, but I'm happy as-is):

 **Unmatched Entries**
 error: Received disconnect from 103.99.0.192 port 63974:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 64517:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 59701:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "ftp" : 1 time(s)
 error: Received disconnect from 117.3.171.144 port 58977:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Connection reset by 58.218.198.136 port 19472 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 58480:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 58630:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 58046:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 55226:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "daemon" : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 53209:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 117.3.171.144 port 60487:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 62172:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 56473:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 61170:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 53823:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 63945:14: No more user authentication methods available. [preauth] : 1 time(s)
 PAM service(sshd) ignoring max retries; 6 > 3 : 1576 time(s)
 Disconnecting: Too many authentication failures [preauth] : 1576 time(s)
 error: Received disconnect from 103.99.0.192 port 50223:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 57263:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "operator" : 1 time(s)
 Connection reset by 58.218.198.136 port 17298 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 65186:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 52288:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "sshd" : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root" : 15120 time(s)
 error: Received disconnect from 103.99.0.192 port 51303:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 60692:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 52006:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 63243:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 59807:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 117.3.171.144 port 59485:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 50777:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 62449:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "nagios" : 11 time(s)
 error: Received disconnect from 103.99.0.192 port 61340:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 62611:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 54615:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 117.3.171.144 port 60116:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 55922:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 59531:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 58.218.198.136 port 33709 [preauth] : 1 time(s)
 Connection reset by 58.218.198.136 port 36905 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 49545:14: No more user authentication methods available. [preauth] : 1 time(s)
Comment 15 Robert Scheck 2018-02-07 23:01:02 UTC 
(In reply to alex from comment #14)
> I still have a few annoying unmatched lines, but with this patch logwatch is
> down to a manageable size, good enough for me.
> 
> You can close the bug if you want.
> 
> The unmatched lines (in case you want to "fix" them, but I'm happy as-is):

Given I am the reporter of this bug report, this decision is outside of your
scope, sorry. The remaining unmatched entries need to be adressed.
Comment 16 Jan Synacek 2018-02-08 11:58:11 UTC 
(In reply to alex from comment #14)
>  **Unmatched Entries**
>  error: Received disconnect from 103.99.0.192 port 63974:14: No more user

I wonder where the "error: " prefix comes from... I have already fixed this.

I also wonder. Do all those unmatched entries come from the sshd service output?
Comment 17 Robert Scheck 2018-02-22 16:20:39 UTC 
logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v2.noarch.rpm still
leaves me at least with this this logwatch output for sshd:

 **Unmatched Entries**
 error: Received disconnect from 103.99.0.192 port 63883:14: No more user authentication methods available. [preauth] : 1 time(s)
 Unable to negotiate with 216.68.72.73 port 46975: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 Unable to negotiate with 78.31.51.53 port 57469: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 Disconnecting: Change of username or service not allowed: (,ssh-connection) -> (admin,ssh-connection) [preauth] : 7 time(s)
 Unable to negotiate with 54.149.60.35 port 58060: no matching host key type found. Their offer: ecdsa-sha2-nistp384 [preauth] : 1 time(s)
 Connection reset by 196.52.43.118 port 43890 [preauth] : 1 time(s)
 Unable to negotiate with 13.56.234.248 port 34726: no matching host key type found. Their offer: ecdsa-sha2-nistp521 [preauth] : 1 time(s)
 Unable to negotiate with 198.245.63.79 port 52141: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 59249:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 50967:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 52495:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 2607:ff10:c5:509a::10 port 49194 [preauth] : 1 time(s)
 Unable to negotiate with 18.144.28.90 port 54654: no matching host key type found. Their offer: ecdsa-sha2-nistp521 [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "daemon" : 3 time(s)
 Unable to negotiate with 54.187.96.148 port 38398: no matching host key type found. Their offer: ecdsa-sha2-nistp521 [preauth] : 1 time(s)
 Unable to negotiate with 54.187.96.148 port 53008: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 error: Received disconnect from 62.210.252.137 port 64425:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Unable to negotiate with 54.149.60.35 port 60834: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 63781:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 59546:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 61449:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 49451:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Unable to negotiate with 54.92.160.226 port 42394: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 Unable to negotiate with 128.232.21.75 port 56430: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 Unable to negotiate with 54.92.160.226 port 40926: no matching host key type found. Their offer: ecdsa-sha2-nistp384 [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 62964 [preauth] : 1 time(s)
 Protocol major versions differ for 185.104.187.61 port 42686: SSH-2.0-OpenSSH_7.4 vs. SSH-1.33-OpenVASSSH_1.0 : 1 time(s)
 Unable to negotiate with 54.187.96.148 port 38010: no matching host key type found. Their offer: ecdsa-sha2-nistp384 [preauth] : 1 time(s)
 Unable to negotiate with 18.144.28.90 port 53788: no matching host key type found. Their offer: ecdsa-sha2-nistp384 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 49959:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 55207:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 63898:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 58922:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 52514:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 62221 [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 64703:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Unable to negotiate with 54.92.160.226 port 41414: no matching host key type found. Their offer: ecdsa-sha2-nistp521 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 54108:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 59161:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 103.207.39.219 port 49345:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Protocol major versions differ for 185.104.187.61 port 33010: SSH-2.0-OpenSSH_7.4 vs. SSH-1.5-OpenVASSSH_1.0 : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "nagios" : 14 time(s)
 Connection reset by 195.154.102.207 port 62460 [preauth] : 1 time(s)
 Connection reset by 83.12.163.41 port 56801 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 56575:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 103.89.90.72 port 63415 [preauth] : 1 time(s)
 error: Received disconnect from 103.89.91.206 port 52961:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "mail" : 3 time(s)
 Connection reset by 196.52.43.62 port 54630 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 58323:14: No more user authentication methods available. [preauth] : 1 time(s)
 Disconnecting: Change of username or service not allowed: (admin,ssh-connection) -> (master,ssh-connection) [preauth] : 3 time(s)
 Unable to negotiate with 172.104.23.44 port 48028: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 Unable to negotiate with 95.43.251.225 port 9291: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 56260:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 115.238.245.8 port 43264 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 63801:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 23.234.8.64 port 59858 [preauth] : 1 time(s)
 Unable to negotiate with 13.56.234.248 port 34056: no matching host key type found. Their offer: ecdsa-sha2-nistp384 [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "ntp" : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "ftp" : 2 time(s)
 error: Received disconnect from 83.12.163.41 port 58013:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 57070:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 164.52.24.138 port 50604 [preauth] : 1 time(s)
 Connection reset by 190.94.4.102 port 55049 [preauth] : 1 time(s)
 Connection reset by 94.101.87.83 port 45321 [preauth] : 1 time(s)
 error: Received disconnect from 117.3.171.144 port 60455:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 62604 [preauth] : 1 time(s)
 Connection reset by 164.52.24.138 port 56265 [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 51140:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 50385:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 61723 [preauth] : 1 time(s)
 Connection reset by 121.18.238.125 port 47624 [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "bin" : 6 time(s)
 error: Received disconnect from 103.99.0.192 port 61522:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 63019 [preauth] : 1 time(s)
 Connection reset by 196.52.43.61 port 49647 [preauth] : 1 time(s)
 Unable to negotiate with 74.220.219.104 port 48313: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 59973:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "sync" : 2 time(s)
 error: Received disconnect from 103.89.91.206 port 62827:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Connection reset by 109.169.49.159 port 6154 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 60202:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 185.35.63.98 port 55040:7: User interaction is not allowed [preauth] : 1 time(s)
 Disconnecting: Too many authentication failures [preauth] : 579 time(s)
 Connection reset by 195.154.102.207 port 62214 [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "operator" : 8 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "nobody" : 3 time(s)
 Connection reset by 103.207.39.219 port 49786 [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "sshd" : 4 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "root" : 1623 time(s)
 Unable to negotiate with 18.144.28.90 port 56194: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 54944:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 121.18.238.125 port 35791 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 55866:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 65516:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Unable to negotiate with 13.56.234.248 port 36346: no matching host key type found. Their offer: ssh-dss [preauth] : 1 time(s)
 Connection reset by 164.52.24.138 port 40415 [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 62723 [preauth] : 1 time(s)
 Connection reset by 121.18.238.39 port 58304 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 53548:14: No more user authentication methods available. [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "adm" : 3 time(s)
 error: Received disconnect from 103.99.0.192 port 51619:14: No more user authentication methods available. [preauth] : 1 time(s)
 error: Received disconnect from 83.12.163.41 port 57116:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.89.91.206 port 62972:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 error: Received disconnect from 103.89.91.206 port 50749:3: com.jcraft.jsch.JSchException: Auth fail [preauth] : 1 time(s)
 Connection reset by 164.52.24.138 port 36497 [preauth] : 1 time(s)
 Unable to negotiate with 54.149.60.35 port 58768: no matching host key type found. Their offer: ecdsa-sha2-nistp521 [preauth] : 1 time(s)
 Connection reset by 183.91.67.196 port 58053 [preauth] : 1 time(s)
 Connection reset by 164.52.24.138 port 41259 [preauth] : 1 time(s)
 Connection reset by 94.102.49.190 port 42586 [preauth] : 1 time(s)
 Connection reset by 195.154.102.207 port 62272 [preauth] : 1 time(s)
 Connection reset by 196.52.43.86 port 50488 [preauth] : 1 time(s)
 Connection reset by 103.207.37.141 port 49259 [preauth] : 1 time(s)
 pam_succeed_if(sshd:auth): requirement "uid >= 1000" not met by user "halt" : 1 time(s)
 Unable to negotiate with 62.100.206.233 port 57456: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 Unable to negotiate with 84.200.78.78 port 59150: no matching cipher found. Their offer: none [preauth] : 1 time(s)
 Connection reset by 46.243.189.99 port 58853 [preauth] : 1 time(s)
 error: Received disconnect from 103.99.0.192 port 64285:14: No more user authentication methods available. [preauth] : 1 time(s)
 Connection reset by 164.52.24.138 port 44592 [preauth] : 1 time(s)

Looks like we need a v3 ;-)
Comment 20 Jan Synacek 2018-04-16 13:21:44 UTC 
v3:
https://jsynacek.fedorapeople.org/logwatch/logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v3.noarch.rpm

If any more unmatched entries are encountered, please, simply append them as a message to this bugzilla, as you did in comment 17. I'm probably not going to update the testing package every time, but I will collect the unmatched entries and make a testing release after some time.
Comment 21 Robert Scheck 2018-04-17 18:09:35 UTC 
Yes, logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v3 looks way better,
only remaining is:

 **Unmatched Entries**
 pam_sepermit(sshd:auth): Cannot determine the user's name : 57 time(s)

A full log line as example:

Apr 15 16:45:33 tux sshd[8354]: pam_sepermit(sshd:auth): Cannot determine the user's name
Comment 24 Jan Synacek 2018-05-14 11:16:33 UTC 
v4:
https://jsynacek.fedorapeople.org/logwatch/logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v4.noarch.rpm
Comment 25 Robert Scheck 2018-05-14 16:18:09 UTC 
logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v4 looks even better,
however remaining is now (new/fresh logs, never saw them before):

 **Unmatched Entries**
 dispatch_protocol_error: type 97 seq 7 [preauth] : 2 time(s)
 dispatch_protocol_error: type 96 seq 5 [preauth] : 2 time(s)
 dispatch_protocol_error: type 90 seq 5 [preauth] : 2 time(s)
 dispatch_protocol_error: type 96 seq 6 [preauth] : 2 time(s)
 dispatch_protocol_error: type 90 seq 4 [preauth] : 2 time(s)
 invalid public DH value: <= 1 [preauth] : 1 time(s)
 dispatch_protocol_error: type 97 seq 6 [preauth] : 2 time(s)

A few full log lines as examples:

Apr 19 07:03:50 tux sshd[25735]: dispatch_protocol_error: type 90 seq 5 [preauth]
May 14 13:07:16 tux sshd[19018]: invalid public DH value: <= 1 [preauth]
Comment 28 Jan Synacek 2018-06-19 09:13:26 UTC 
v5:
https://jsynacek.fedorapeople.org/logwatch/logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v5.noarch.rpm
Comment 32 Robert Scheck 2018-06-20 12:56:17 UTC 
Great, no new issues with logwatch-7.4.0-34.20130522svn140.el7.bz1504979.v5
here. Can we get this into RHEL 7.6 and 7.5.z, please? I'll raise the same
via the case in the Red Hat customer portal for business justification etc.
Comment 37 errata-xmlrpc 2018-10-30 11:24:33 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3222