Skip to content

Commit b0a8aca

Browse files
stacknilstacknil
committed
test: expand sanitized sshd and PAM corpus for parser and report regression
1 parent 9a50f8e commit b0a8aca

11 files changed

Lines changed: 242 additions & 147 deletions

File tree

‎assets/parser_auth_families_journalctl_short_full.log‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
Wed 2026-03-11 10:00:01 UTC example-host sshd[3100]: Accepted publickey for alice from 203.0.113.70 port 53000 ssh2: ED25519 SHA256:SANITIZEDKEY
2+
Wed 2026-03-11 10:00:20 UTC example-host sshd[3101]: Accepted password for bob from 203.0.113.73 port 53001 ssh2
3+
Wed 2026-03-11 10:00:36 UTC example-host sshd[3102]: Failed publickey for invalid user svc-deploy from 203.0.113.74 port 53002 ssh2
24
Wed 2026-03-11 10:00:42 UTC example-host pam_faillock(sshd:auth): Consecutive login failures for user alice account temporarily locked from 203.0.113.71
35
Wed 2026-03-11 10:01:13 UTC example-host pam_faillock(sshd:auth): Authentication failure for user bob from 203.0.113.72
6+
Wed 2026-03-11 10:01:40 UTC example-host pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.0.113.75 user=carol
47
Wed 2026-03-11 10:01:54 UTC example-host pam_faillock(sshd:auth): User carol successfully authenticated
58
Wed 2026-03-11 10:02:25 UTC example-host pam_sss(sshd:auth): received for user dave: 7 (Authentication failure)
6-
Wed 2026-03-11 10:02:56 UTC example-host pam_sss(sshd:auth): received for user erin: 10 (User not known to the underlying authentication module)
7-
Wed 2026-03-11 10:03:27 UTC example-host pam_sss(sshd:auth): received for user frank: 9 (Authentication service cannot retrieve authentication info)
9+
Wed 2026-03-11 10:02:44 UTC example-host pam_unix(sudo:session): session opened for user root by erin(uid=0)
10+
Wed 2026-03-11 10:03:05 UTC example-host pam_faillock(sshd:auth): Account temporarily locked for user frank
11+
Wed 2026-03-11 10:03:24 UTC example-host pam_sss(sshd:auth): received for user grace: 10 (User not known to the underlying authentication module)
12+
Wed 2026-03-11 10:03:43 UTC example-host pam_sss(sshd:auth): received for user heidi: 9 (Authentication service cannot retrieve authentication info)
13+
Wed 2026-03-11 10:04:02 UTC example-host pam_unix(sshd:session): session closed for user alice

‎assets/parser_auth_families_syslog.log‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
11
Mar 11 10:00:01 example-host sshd[2100]: Accepted publickey for alice from 203.0.113.70 port 53000 ssh2: ED25519 SHA256:SANITIZEDKEY
2+
Mar 11 10:00:20 example-host sshd[2101]: Accepted password for bob from 203.0.113.73 port 53001 ssh2
3+
Mar 11 10:00:36 example-host sshd[2102]: Failed publickey for invalid user svc-deploy from 203.0.113.74 port 53002 ssh2
24
Mar 11 10:00:42 example-host pam_faillock(sshd:auth): Consecutive login failures for user alice account temporarily locked from 203.0.113.71
35
Mar 11 10:01:13 example-host pam_faillock(sshd:auth): Authentication failure for user bob from 203.0.113.72
6+
Mar 11 10:01:40 example-host pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.0.113.75 user=carol
47
Mar 11 10:01:54 example-host pam_faillock(sshd:auth): User carol successfully authenticated
58
Mar 11 10:02:25 example-host pam_sss(sshd:auth): received for user dave: 7 (Authentication failure)
6-
Mar 11 10:02:56 example-host pam_sss(sshd:auth): received for user erin: 10 (User not known to the underlying authentication module)
7-
Mar 11 10:03:27 example-host pam_sss(sshd:auth): received for user frank: 9 (Authentication service cannot retrieve authentication info)
9+
Mar 11 10:02:44 example-host pam_unix(sudo:session): session opened for user root by erin(uid=0)
10+
Mar 11 10:03:05 example-host pam_faillock(sshd:auth): Account temporarily locked for user frank
11+
Mar 11 10:03:24 example-host pam_sss(sshd:auth): received for user grace: 10 (User not known to the underlying authentication module)
12+
Mar 11 10:03:43 example-host pam_sss(sshd:auth): received for user heidi: 9 (Authentication service cannot retrieve authentication info)
13+
Mar 11 10:04:02 example-host pam_unix(sshd:session): session closed for user alice

‎assets/parser_fixture_matrix_journalctl_short_full.log‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,13 @@ Tue 2026-03-10 09:01:15 UTC example-host sshd[3002]: Invalid user backup from 20
44
Tue 2026-03-10 09:01:52 UTC example-host pam_unix(sshd:auth): authentication failure; user=alice euid=0 tty=ssh rhost=203.0.113.40
55
Tue 2026-03-10 09:02:30 UTC example-host pam_unix(sudo:session): session opened for user root(uid=0) by alice(uid=1000)
66
Tue 2026-03-10 09:03:05 UTC example-host pam_unix(su-l:session): session opened for user root by bob(uid=1001)
7+
Tue 2026-03-10 09:03:28 UTC example-host sshd[3008]: Accepted password for alice from 203.0.113.41 port 52003 ssh2
8+
Tue 2026-03-10 09:03:34 UTC example-host sshd[3009]: Accepted publickey for carol from 203.0.113.42 port 52004 ssh2: ED25519 SHA256:SANITIZEDKEY2
79
Tue 2026-03-10 09:03:40 UTC example-host sshd[3003]: Connection closed by user alice 203.0.113.50 port 52010 [preauth]
810
Tue 2026-03-10 09:04:05 UTC example-host sshd[3004]: Connection closed by authenticating user carol 203.0.113.51 port 52011 [preauth]
911
Tue 2026-03-10 09:04:28 UTC example-host sshd[3005]: Connection closed by invalid user deploy 203.0.113.52 port 52012 [preauth]
1012
Tue 2026-03-10 09:05:02 UTC example-host sshd[3006]: Disconnected from authenticating user dave 203.0.113.53 port 52013 [preauth]
1113
Tue 2026-03-10 09:05:34 UTC example-host sshd[3007]: Timeout, client not responding from 203.0.113.54 port 52014
14+
Tue 2026-03-10 09:05:46 UTC example-host sshd[3010]: Received disconnect from 203.0.113.55 port 52015:11: disconnected by user
15+
Tue 2026-03-10 09:05:58 UTC example-host sshd[3011]: Unable to negotiate with 203.0.113.56 port 52016: no matching host key type found. Their offer: ssh-rsa
1216
Tue 2026-03-10 09:06:10 UTC example-host pam_unix(sshd:session): session closed for user alice

‎assets/parser_fixture_matrix_syslog.log‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,13 @@ Mar 10 09:01:15 example-host sshd[2002]: Invalid user backup from 203.0.113.12 p
44
Mar 10 09:01:52 example-host pam_unix(sshd:auth): authentication failure; user=alice euid=0 tty=ssh rhost=203.0.113.40
55
Mar 10 09:02:30 example-host pam_unix(sudo:session): session opened for user root(uid=0) by alice(uid=1000)
66
Mar 10 09:03:05 example-host pam_unix(su-l:session): session opened for user root by bob(uid=1001)
7+
Mar 10 09:03:28 example-host sshd[2008]: Accepted password for alice from 203.0.113.41 port 52003 ssh2
8+
Mar 10 09:03:34 example-host sshd[2009]: Accepted publickey for carol from 203.0.113.42 port 52004 ssh2: ED25519 SHA256:SANITIZEDKEY2
79
Mar 10 09:03:40 example-host sshd[2003]: Connection closed by user alice 203.0.113.50 port 52010 [preauth]
810
Mar 10 09:04:05 example-host sshd[2004]: Connection closed by authenticating user carol 203.0.113.51 port 52011 [preauth]
911
Mar 10 09:04:28 example-host sshd[2005]: Connection closed by invalid user deploy 203.0.113.52 port 52012 [preauth]
1012
Mar 10 09:05:02 example-host sshd[2006]: Disconnected from authenticating user dave 203.0.113.53 port 52013 [preauth]
1113
Mar 10 09:05:34 example-host sshd[2007]: Timeout, client not responding from 203.0.113.54 port 52014
14+
Mar 10 09:05:46 example-host sshd[2010]: Received disconnect from 203.0.113.55 port 52015:11: disconnected by user
15+
Mar 10 09:05:58 example-host sshd[2011]: Unable to negotiate with 203.0.113.56 port 52016: no matching host key type found. Their offer: ssh-rsa
1216
Mar 10 09:06:10 example-host pam_unix(sshd:session): session closed for user alice

‎tests/fixtures/report_contracts/multi_host_journalctl_short_full/input.log‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,13 @@ Wed 2026-03-11 09:01:05 UTC alpha-host sshd[2302]: Failed password for root from
33
Wed 2026-03-11 09:02:10 UTC alpha-host sshd[2303]: Failed password for test from 203.0.113.10 port 52040 ssh2
44
Wed 2026-03-11 09:03:44 UTC alpha-host sshd[2304]: Failed password for guest from 203.0.113.10 port 52050 ssh2
55
Wed 2026-03-11 09:04:05 UTC alpha-host sshd[2305]: Failed password for invalid user deploy from 203.0.113.10 port 52060 ssh2
6+
Wed 2026-03-11 09:05:20 UTC alpha-host sshd[2306]: Accepted password for ops from 203.0.113.60 port 52070 ssh2
7+
Wed 2026-03-11 09:06:02 UTC alpha-host pam_faillock(sshd:auth): Authentication failure for user svc-ci from 203.0.113.61
68
Wed 2026-03-11 09:10:10 UTC beta-host sshd[2401]: Accepted publickey for alice from 203.0.113.20 port 52111 ssh2
79
Wed 2026-03-11 09:11:00 UTC beta-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart ssh
810
Wed 2026-03-11 09:12:10 UTC beta-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/journalctl -xe
11+
Wed 2026-03-11 09:13:02 UTC beta-host pam_sss(sshd:auth): received for user mallory: 7 (Authentication failure)
12+
Wed 2026-03-11 09:13:38 UTC beta-host pam_sss(sshd:auth): received for user ghost: 10 (User not known to the underlying authentication module)
913
Wed 2026-03-11 09:14:15 UTC beta-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/vi /etc/ssh/sshd_config
10-
Wed 2026-03-11 09:15:12 UTC alpha-host sshd[2306]: Connection closed by authenticating user alice 203.0.113.50 port 52290 [preauth]
14+
Wed 2026-03-11 09:15:12 UTC alpha-host sshd[2307]: Connection closed by authenticating user alice 203.0.113.50 port 52290 [preauth]
1115
Wed 2026-03-11 09:16:18 UTC beta-host sshd[2402]: Timeout, client not responding from 203.0.113.51 port 52291

‎tests/fixtures/report_contracts/multi_host_journalctl_short_full/report.json‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,42 +4,48 @@
44
"input_mode": "journalctl_short_full",
55
"timezone_present": true,
66
"parser_quality": {
7-
"total_lines": 11,
8-
"parsed_lines": 9,
9-
"unparsed_lines": 2,
10-
"parse_success_rate": 0.8182,
7+
"total_lines": 15,
8+
"parsed_lines": 12,
9+
"unparsed_lines": 3,
10+
"parse_success_rate": 0.8000,
1111
"top_unknown_patterns": [
12+
{"pattern": "pam_sss_unknown_user", "count": 1},
1213
{"pattern": "sshd_connection_closed_preauth", "count": 1},
1314
{"pattern": "sshd_timeout_or_disconnection", "count": 1}
1415
]
1516
},
16-
"parsed_event_count": 9,
17-
"warning_count": 2,
17+
"parsed_event_count": 12,
18+
"warning_count": 3,
1819
"finding_count": 3,
1920
"event_counts": [
2021
{"event_type": "ssh_failed_password", "count": 3},
22+
{"event_type": "ssh_accepted_password", "count": 1},
2123
{"event_type": "ssh_accepted_publickey", "count": 1},
2224
{"event_type": "ssh_invalid_user", "count": 2},
25+
{"event_type": "pam_auth_failure", "count": 2},
2326
{"event_type": "sudo_command", "count": 3}
2427
],
2528
"host_summaries": [
2629
{
2730
"hostname": "alpha-host",
28-
"parsed_event_count": 5,
31+
"parsed_event_count": 7,
2932
"finding_count": 2,
3033
"warning_count": 1,
3134
"event_counts": [
3235
{"event_type": "ssh_failed_password", "count": 3},
33-
{"event_type": "ssh_invalid_user", "count": 2}
36+
{"event_type": "ssh_accepted_password", "count": 1},
37+
{"event_type": "ssh_invalid_user", "count": 2},
38+
{"event_type": "pam_auth_failure", "count": 1}
3439
]
3540
},
3641
{
3742
"hostname": "beta-host",
38-
"parsed_event_count": 4,
43+
"parsed_event_count": 5,
3944
"finding_count": 1,
40-
"warning_count": 1,
45+
"warning_count": 2,
4146
"event_counts": [
4247
{"event_type": "ssh_accepted_publickey", "count": 1},
48+
{"event_type": "pam_auth_failure", "count": 1},
4349
{"event_type": "sudo_command", "count": 3}
4450
]
4551
}
@@ -77,7 +83,8 @@
7783
}
7884
],
7985
"warnings": [
80-
{"line_number": 10, "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
81-
{"line_number": 11, "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
86+
{"line_number": 12, "reason": "unrecognized auth pattern: pam_sss_unknown_user"},
87+
{"line_number": 14, "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
88+
{"line_number": 15, "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
8289
]
8390
}

‎tests/fixtures/report_contracts/multi_host_journalctl_short_full/report.md‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,20 @@
55
- Input: `tests/fixtures/report_contracts/multi_host_journalctl_short_full/input.log`
66
- Input mode: journalctl_short_full
77
- Timezone present: true
8-
- Total lines: 11
9-
- Parsed lines: 9
10-
- Unparsed lines: 2
11-
- Parse success rate: 81.82%
12-
- Parsed events: 9
8+
- Total lines: 15
9+
- Parsed lines: 12
10+
- Unparsed lines: 3
11+
- Parse success rate: 80.00%
12+
- Parsed events: 12
1313
- Findings: 3
14-
- Parser warnings: 2
14+
- Parser warnings: 3
1515

1616
## Host Summary
1717

1818
| Host | Parsed Events | Findings | Warnings |
1919
| --- | ---: | ---: | ---: |
20-
| alpha-host | 5 | 2 | 1 |
21-
| beta-host | 4 | 1 | 1 |
20+
| alpha-host | 7 | 2 | 1 |
21+
| beta-host | 5 | 1 | 2 |
2222

2323
## Findings
2424

@@ -33,20 +33,24 @@
3333
| Event Type | Count |
3434
| --- | ---: |
3535
| ssh_failed_password | 3 |
36+
| ssh_accepted_password | 1 |
3637
| ssh_accepted_publickey | 1 |
3738
| ssh_invalid_user | 2 |
39+
| pam_auth_failure | 2 |
3840
| sudo_command | 3 |
3941

4042
## Parser Quality
4143

4244
| Unknown Pattern | Count |
4345
| --- | ---: |
46+
| pam_sss_unknown_user | 1 |
4447
| sshd_connection_closed_preauth | 1 |
4548
| sshd_timeout_or_disconnection | 1 |
4649

4750
## Parser Warnings
4851

4952
| Line | Reason |
5053
| ---: | --- |
51-
| 10 | unrecognized auth pattern: sshd_connection_closed_preauth |
52-
| 11 | unrecognized auth pattern: sshd_timeout_or_disconnection |
54+
| 12 | unrecognized auth pattern: pam_sss_unknown_user |
55+
| 14 | unrecognized auth pattern: sshd_connection_closed_preauth |
56+
| 15 | unrecognized auth pattern: sshd_timeout_or_disconnection |

‎tests/fixtures/report_contracts/multi_host_syslog_legacy/input.log‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,13 @@ Mar 11 09:01:05 alpha-host sshd[1302]: Failed password for root from 203.0.113.1
33
Mar 11 09:02:10 alpha-host sshd[1303]: Failed password for test from 203.0.113.10 port 52040 ssh2
44
Mar 11 09:03:44 alpha-host sshd[1304]: Failed password for guest from 203.0.113.10 port 52050 ssh2
55
Mar 11 09:04:05 alpha-host sshd[1305]: Failed password for invalid user deploy from 203.0.113.10 port 52060 ssh2
6+
Mar 11 09:05:20 alpha-host sshd[1306]: Accepted password for ops from 203.0.113.60 port 52070 ssh2
7+
Mar 11 09:06:02 alpha-host pam_faillock(sshd:auth): Authentication failure for user svc-ci from 203.0.113.61
68
Mar 11 09:10:10 beta-host sshd[1401]: Accepted publickey for alice from 203.0.113.20 port 52111 ssh2
79
Mar 11 09:11:00 beta-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/systemctl restart ssh
810
Mar 11 09:12:10 beta-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/journalctl -xe
11+
Mar 11 09:13:02 beta-host pam_sss(sshd:auth): received for user mallory: 7 (Authentication failure)
12+
Mar 11 09:13:38 beta-host pam_sss(sshd:auth): received for user ghost: 10 (User not known to the underlying authentication module)
913
Mar 11 09:14:15 beta-host sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/vi /etc/ssh/sshd_config
10-
Mar 11 09:15:12 alpha-host sshd[1306]: Connection closed by authenticating user alice 203.0.113.50 port 52290 [preauth]
14+
Mar 11 09:15:12 alpha-host sshd[1307]: Connection closed by authenticating user alice 203.0.113.50 port 52290 [preauth]
1115
Mar 11 09:16:18 beta-host sshd[1402]: Timeout, client not responding from 203.0.113.51 port 52291

‎tests/fixtures/report_contracts/multi_host_syslog_legacy/report.json‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,42 +5,48 @@
55
"assume_year": 2026,
66
"timezone_present": false,
77
"parser_quality": {
8-
"total_lines": 11,
9-
"parsed_lines": 9,
10-
"unparsed_lines": 2,
11-
"parse_success_rate": 0.8182,
8+
"total_lines": 15,
9+
"parsed_lines": 12,
10+
"unparsed_lines": 3,
11+
"parse_success_rate": 0.8000,
1212
"top_unknown_patterns": [
13+
{"pattern": "pam_sss_unknown_user", "count": 1},
1314
{"pattern": "sshd_connection_closed_preauth", "count": 1},
1415
{"pattern": "sshd_timeout_or_disconnection", "count": 1}
1516
]
1617
},
17-
"parsed_event_count": 9,
18-
"warning_count": 2,
18+
"parsed_event_count": 12,
19+
"warning_count": 3,
1920
"finding_count": 3,
2021
"event_counts": [
2122
{"event_type": "ssh_failed_password", "count": 3},
23+
{"event_type": "ssh_accepted_password", "count": 1},
2224
{"event_type": "ssh_accepted_publickey", "count": 1},
2325
{"event_type": "ssh_invalid_user", "count": 2},
26+
{"event_type": "pam_auth_failure", "count": 2},
2427
{"event_type": "sudo_command", "count": 3}
2528
],
2629
"host_summaries": [
2730
{
2831
"hostname": "alpha-host",
29-
"parsed_event_count": 5,
32+
"parsed_event_count": 7,
3033
"finding_count": 2,
3134
"warning_count": 1,
3235
"event_counts": [
3336
{"event_type": "ssh_failed_password", "count": 3},
34-
{"event_type": "ssh_invalid_user", "count": 2}
37+
{"event_type": "ssh_accepted_password", "count": 1},
38+
{"event_type": "ssh_invalid_user", "count": 2},
39+
{"event_type": "pam_auth_failure", "count": 1}
3540
]
3641
},
3742
{
3843
"hostname": "beta-host",
39-
"parsed_event_count": 4,
44+
"parsed_event_count": 5,
4045
"finding_count": 1,
41-
"warning_count": 1,
46+
"warning_count": 2,
4247
"event_counts": [
4348
{"event_type": "ssh_accepted_publickey", "count": 1},
49+
{"event_type": "pam_auth_failure", "count": 1},
4450
{"event_type": "sudo_command", "count": 3}
4551
]
4652
}
@@ -78,7 +84,8 @@
7884
}
7985
],
8086
"warnings": [
81-
{"line_number": 10, "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
82-
{"line_number": 11, "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
87+
{"line_number": 12, "reason": "unrecognized auth pattern: pam_sss_unknown_user"},
88+
{"line_number": 14, "reason": "unrecognized auth pattern: sshd_connection_closed_preauth"},
89+
{"line_number": 15, "reason": "unrecognized auth pattern: sshd_timeout_or_disconnection"}
8390
]
8491
}

‎tests/fixtures/report_contracts/multi_host_syslog_legacy/report.md‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,20 @@
66
- Input mode: syslog_legacy
77
- Assume year: 2026
88
- Timezone present: false
9-
- Total lines: 11
10-
- Parsed lines: 9
11-
- Unparsed lines: 2
12-
- Parse success rate: 81.82%
13-
- Parsed events: 9
9+
- Total lines: 15
10+
- Parsed lines: 12
11+
- Unparsed lines: 3
12+
- Parse success rate: 80.00%
13+
- Parsed events: 12
1414
- Findings: 3
15-
- Parser warnings: 2
15+
- Parser warnings: 3
1616

1717
## Host Summary
1818

1919
| Host | Parsed Events | Findings | Warnings |
2020
| --- | ---: | ---: | ---: |
21-
| alpha-host | 5 | 2 | 1 |
22-
| beta-host | 4 | 1 | 1 |
21+
| alpha-host | 7 | 2 | 1 |
22+
| beta-host | 5 | 1 | 2 |
2323

2424
## Findings
2525

@@ -34,20 +34,24 @@
3434
| Event Type | Count |
3535
| --- | ---: |
3636
| ssh_failed_password | 3 |
37+
| ssh_accepted_password | 1 |
3738
| ssh_accepted_publickey | 1 |
3839
| ssh_invalid_user | 2 |
40+
| pam_auth_failure | 2 |
3941
| sudo_command | 3 |
4042

4143
## Parser Quality
4244

4345
| Unknown Pattern | Count |
4446
| --- | ---: |
47+
| pam_sss_unknown_user | 1 |
4548
| sshd_connection_closed_preauth | 1 |
4649
| sshd_timeout_or_disconnection | 1 |
4750

4851
## Parser Warnings
4952

5053
| Line | Reason |
5154
| ---: | --- |
52-
| 10 | unrecognized auth pattern: sshd_connection_closed_preauth |
53-
| 11 | unrecognized auth pattern: sshd_timeout_or_disconnection |
55+
| 12 | unrecognized auth pattern: pam_sss_unknown_user |
56+
| 14 | unrecognized auth pattern: sshd_connection_closed_preauth |
57+
| 15 | unrecognized auth pattern: sshd_timeout_or_disconnection |

0 commit comments

Comments
 (0)