From 217d9e4862c718d4bc3e936cd245ea56c2aa21cc Mon Sep 17 00:00:00 2001
From: Remko Lodder <remko@FreeBSD.org>
Date: Fri, 23 Feb 2007 21:42:54 +0000
Subject: [PATCH] Only match on log messages containing fail,invalid, bad or
 illegal. This prevents matching on systems that have a name that matches the
 query.

PR:		conf/107560
Submitted by:	Christian Laursen <cfsl at pil dot dk>
MFC after:	3 days
Approved by:	imp (mentor)
---
 etc/periodic/security/800.loginfail | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/periodic/security/800.loginfail b/etc/periodic/security/800.loginfail
index 6a26f7d89c7..38aeb021af4 100755
--- a/etc/periodic/security/800.loginfail
+++ b/etc/periodic/security/800.loginfail
@@ -59,7 +59,7 @@ case "$daily_status_security_loginfail_enable" in
     [Yy][Ee][Ss])
 	echo ""
 	echo "${host} login failures:"
-	n=$(catmsgs | egrep -ia "^$yesterday.*(fail|invalid|bad|illegal)" |
+	n=$(catmsgs | egrep -ia "^$yesterday.*: .* (fail|invalid|bad|illegal)" |
 	    tee /dev/stderr | wc -l)
 	[ $n -gt 0 ] && rc=1 || rc=0;;
     *)	rc=0;;