Bug 2044101 - logwatch sshd report should sort failed logins and illegal users by count, not IP address
Summary: logwatch sshd report should sort failed logins and illegal users by count, no...
Keywords:
Status: ON_QA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: logwatch
Version: CentOS Stream
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Pavel Šimovec
QA Contact: Karel Volný
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-01-23 21:47 UTC by Jonathan Kamens
Modified: 2023-08-17 13:30 UTC (History)
3 users (show)

Fixed In Version: logwatch-7.4.3-20.el8
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
sort failed logins and invalid users by count (828 bytes, patch)
2022-01-23 21:47 UTC, Jonathan Kamens 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-109276 0 None None None 2022-01-23 21:55:52 UTC

Description Jonathan Kamens 2022-01-23 21:47:08 UTC 
Created attachment 1852935 [details]
sort failed logins and invalid users by count

The sections of the sshd report in logwatch that list failed logins by IP and invalid usernames by IP should sort by the count per IP, which is extremely useful, not by the IP address, which is completely useless as a sort metric.

No one wants to see the IP addresses in lexical order. Everyone wants to see the biggest offenders first.

See attached diff.
Note You need to log in before you can comment on or make changes to this bug.