I have a fedora machine set up to backup configs and information from other servers via scp.

In the daily log watch report I am getting tons of

Received disconnect from some.ip.add.ress port someport:11: : 1 Time

For some reason logwatch is marking the ssh/scp disconnects as “Unmatched Entries”  To eliminate these extrainious entries in the report add the line

Received disconnect from .*

to /etc/logwatch/conf/ignore.conf