From 8825a5f31b984fe52f705df6cec4720c9c1f0beb Mon Sep 17 00:00:00 2001
From: Markus Oesterle <markusoesterle@gmx.de>
Date: Thu, 16 Apr 2015 19:48:28 +0200
Subject: [PATCH] updated filter.d/sshd.conf

Added line to match sshd auth errors on OpenSuSE systems
---
 config/filter.d/sshd.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index 6589e21b..f6274a30 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -33,6 +33,7 @@ failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|erro
             ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
             ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
             ^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
+             ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure.*rhost=<HOST>\s.*$
 
 ignoreregex =