[Logwatch] ssh logs - failed logins ?

Terry Davis tdavis@approbation.org
Sun, 30 Jun 2002 16:20:22 -0500


Hello,

Here is what I see in my logwatch email:

Failed logins from these:
    jomama/none from 10.10.1.7: 96 time(s)

Here is what I see in my /var/log/messages:
Jun 30 05:43:46 zeus sshd(pam_unix)[26389]: session opened for user 
jomama by (uid=0)
Jun 30 05:43:55 zeus sshd(pam_unix)[26389]: session closed for user jomama
Jun 30 05:44:14 zeus sshd(pam_unix)[26398]: session opened for user 
jomama by (uid=0)
Jun 30 05:44:21 zeus sshd(pam_unix)[26398]: session closed for user jomama
Jun 30 05:44:39 zeus sshd(pam_unix)[26408]: session opened for user 
jomama by (uid=0)
Jun 30 05:44:50 zeus sshd(pam_unix)[26408]: session closed for user jomama

Why is logwatch seeing these as a failed logins?  Am I missing something 
here?  I know that this user is getting logged in correctly.

Thank you,
Terry