# SPDX-License-Identifier: AGPL-3.0-only
# A connection dropped before authentication, WITH NOBODY NAMED:
#   Connection closed by 203.0.113.9 port 47782 [preauth]
#   Disconnected from 203.0.113.9 port 57134 [preauth]
#
# Weak evidence on purpose. A port scanner writes these, and so does a
# monitoring probe checking the port is open, and so does a phone on a
# bad connection. Nothing says anyone tried to get in.
#
# The moment sshd names an account, it is a different line and a
# different parser: see ssh-auth-abandoned, which is worth as much as a
# refused password. Keeping them apart is the whole point — merged, the
# weight had to suit the weaker one, and a real attempt on root scored
# a single point.
parser: ssh-preauth-abort
log: ssh
prefilter: "[preauth]"
regex: '^(?P<time>\S+(?: +\d+ \d\d:\d\d:\d\d)?) \S+ sshd(?:-session)?\[\d+\]: (?:Connection closed by|Connection reset by|Disconnected from) (?P<ip>[0-9a-fA-F.:]+) port \d+ \[preauth\]$'
time_field: time
time_format: rfc3339
