conf/91732: [patch] 800.loginfail: fix log message grep expression

[Skye Poier]

The following reply was made to PR conf/91732; it has been noted by GNATS.

From: "Skye Poier" <spoier at gmail.com>
To: bug-followup at FreeBSD.org, doconnor at gsoft.com.au
Cc:  
Subject: Re: conf/91732: [patch] 800.loginfail: fix log message grep expression
Date: Fri, 11 Aug 2006 17:58:21 -0700

 I noticed the same problem; although I was primarily worried about not
 seeing ssh login failures in the security report.  I discovered it was
 because "fail" no longer appears in the auth.log line on my FreeBSD
 6.1 installation:
 
 Aug 11 08:39:20 hostname sshd[48839]: error: PAM: authentication error
 for someuser from somewhere.pacbell.net
 
 I simply modified the grep in 800.loginfail to read:
 
         n=$(catmsgs | grep -ia "^$yesterday.*\(fail\|authentication error\)" |
             tee /dev/stderr | wc -l)