diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 1c8a02de..a1fd749a 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -16,7 +16,7 @@ before = common.conf
 
 [DEFAULT]
 
-_daemon = sshd
+_daemon = (?:sshd(?:-session)?)
 
 # optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
 __pref = (?:(?:error|fatal): (?:PAM: )?)?