I have a fedora machine set up to backup configs and information from other servers via scp.
In the daily log watch report I am getting tons of
Received disconnect from some.ip.add.ress port someport:11: : 1 Time
For some reason logwatch is marking the ssh/scp disconnects as “Unmatched Entries” To eliminate these extrainious entries in the report add the line
Received disconnect from .*