From 83d5eeb612f9bca21c4dda8286dce357e9e4bd8d Mon Sep 17 00:00:00 2001 From: stacknil Date: Thu, 28 May 2026 11:13:46 +0800 Subject: [PATCH] test(parser): bucket ssh negotiation failures --- src/parser.cpp | 4 ++++ tests/test_parser.cpp | 12 ++++++------ 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/src/parser.cpp b/src/parser.cpp index a7b2a9f..8a7c0f7 100644 --- a/src/parser.cpp +++ b/src/parser.cpp @@ -669,6 +669,10 @@ std::string classify_unknown_auth_pattern(const Event& event) { return "sshd_timeout_or_disconnection"; } + if (message.starts_with("Unable to negotiate with ")) { + return "sshd_negotiation_failure"; + } + return "sshd_other"; } diff --git a/tests/test_parser.cpp b/tests/test_parser.cpp index a2b33c8..385873d 100644 --- a/tests/test_parser.cpp +++ b/tests/test_parser.cpp @@ -695,9 +695,9 @@ void test_syslog_fixture_matrix_file() { expect(result.quality.top_unknown_patterns[2].pattern == "pam_unix_other", "expected unsupported pam_unix syslog bucket"); expect(result.quality.top_unknown_patterns[2].count == 1, "expected one unsupported pam_unix syslog line"); - expect(result.quality.top_unknown_patterns[3].pattern == "sshd_other", - "expected unsupported sshd syslog bucket"); - expect(result.quality.top_unknown_patterns[3].count == 1, "expected one unsupported sshd syslog line"); + expect(result.quality.top_unknown_patterns[3].pattern == "sshd_negotiation_failure", + "expected sshd negotiation-failure syslog bucket"); + expect(result.quality.top_unknown_patterns[3].count == 1, "expected one sshd negotiation-failure syslog line"); } void test_journalctl_fixture_matrix_file() { @@ -759,9 +759,9 @@ void test_journalctl_fixture_matrix_file() { expect(result.quality.top_unknown_patterns[2].pattern == "pam_unix_other", "expected unsupported pam_unix journalctl bucket"); expect(result.quality.top_unknown_patterns[2].count == 1, "expected one unsupported pam_unix journalctl line"); - expect(result.quality.top_unknown_patterns[3].pattern == "sshd_other", - "expected unsupported sshd journalctl bucket"); - expect(result.quality.top_unknown_patterns[3].count == 1, "expected one unsupported sshd journalctl line"); + expect(result.quality.top_unknown_patterns[3].pattern == "sshd_negotiation_failure", + "expected sshd negotiation-failure journalctl bucket"); + expect(result.quality.top_unknown_patterns[3].count == 1, "expected one sshd negotiation-failure journalctl line"); } } // namespace