test(parser): bucket ssh negotiation failures

Author: stacknil

src/parser.cpp

@@ -669,6 +669,10 @@ std::string classify_unknown_auth_pattern(const Event& event) {
             return "sshd_timeout_or_disconnection";
         }
 
+        if (message.starts_with("Unable to negotiate with ")) {
+            return "sshd_negotiation_failure";
+        }
+
         return "sshd_other";
     }
 

tests/test_parser.cpp

@@ -695,9 +695,9 @@ void test_syslog_fixture_matrix_file() {
     expect(result.quality.top_unknown_patterns[2].pattern == "pam_unix_other",
            "expected unsupported pam_unix syslog bucket");
     expect(result.quality.top_unknown_patterns[2].count == 1, "expected one unsupported pam_unix syslog line");
-    expect(result.quality.top_unknown_patterns[3].pattern == "sshd_other",
-           "expected unsupported sshd syslog bucket");
-    expect(result.quality.top_unknown_patterns[3].count == 1, "expected one unsupported sshd syslog line");
+    expect(result.quality.top_unknown_patterns[3].pattern == "sshd_negotiation_failure",
+           "expected sshd negotiation-failure syslog bucket");
+    expect(result.quality.top_unknown_patterns[3].count == 1, "expected one sshd negotiation-failure syslog line");
 }
 
 void test_journalctl_fixture_matrix_file() {
@@ -759,9 +759,9 @@ void test_journalctl_fixture_matrix_file() {
     expect(result.quality.top_unknown_patterns[2].pattern == "pam_unix_other",
            "expected unsupported pam_unix journalctl bucket");
     expect(result.quality.top_unknown_patterns[2].count == 1, "expected one unsupported pam_unix journalctl line");
-    expect(result.quality.top_unknown_patterns[3].pattern == "sshd_other",
-           "expected unsupported sshd journalctl bucket");
-    expect(result.quality.top_unknown_patterns[3].count == 1, "expected one unsupported sshd journalctl line");
+    expect(result.quality.top_unknown_patterns[3].pattern == "sshd_negotiation_failure",
+           "expected sshd negotiation-failure journalctl bucket");
+    expect(result.quality.top_unknown_patterns[3].count == 1, "expected one sshd negotiation-failure journalctl line");
 }
 
 }  // namespace