From 8f3c6480c7d0115be787196ce2d6905ddbaeeb7e Mon Sep 17 00:00:00 2001
From: Gints Polis <polis.gints@gmail.com>
Date: Tue, 3 Feb 2026 18:19:43 +0200
Subject: [PATCH] #19 also count connection failures - is not permitted to log

---
 src/aggregators/connections.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/aggregators/connections.rs b/src/aggregators/connections.rs
index 70d18f7..d4297c9 100644
--- a/src/aggregators/connections.rs
+++ b/src/aggregators/connections.rs
@@ -49,7 +49,8 @@ impl Aggregator for ConnectionsAggregator {
                     record: String::from_utf8(record.to_vec()).unwrap(),
                 })?;
         if (severity == Severity::Fatal)
-            && memchr::memmem::find(record, b"password authentication failed").is_some()
+            && (memchr::memmem::find(record, b"password authentication failed").is_some()
+                || memchr::memmem::find(record, b"is not permitted to log in").is_some())
         {
             self.connection_failures += 1;
             return Ok(());