This sounds familiar, I think a fix for it may have come through recently. Is this still reproducible on eoan or focal?
More explicit steps to reproduce this (so we can do it in an lxc container) would help a lot. ** Changed in: logwatch (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1720710 Title: "Message repeated" entries in auth.log show wrong username in logwatch To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/logwatch/+bug/1720710/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs