Handle prefix in auth.log

DigitalRuby · Jan 18, 2019 · b91f5ed · b91f5ed
1 parent f98b17b
commit b91f5ed
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/app.config b/app.config
@@ -35,8 +35,8 @@
         -->
         <Regex>
           <![CDATA[
-            ^\s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+failed\s+password\s+for(\sinvalid\suser)?\s+(?<username>.+?)\s+from\s+(?<ipaddress>.+?)\s+port\s+[0-9]+\s+ssh2?\s*$|
-            ^\s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+connection\s+closed\s+by\s+((invalid\s+user\s+)?(?<username>.+?)\s+)?(?<ipaddress>.+?)\s+port\s+[0-9]+\s+\[preauth\]\s*$
+            \s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+failed\s+password\s+for(\sinvalid\suser)?\s+(?<username>.+?)\s+from\s+(?<ipaddress>.+?)\s+port\s+[0-9]+\s+ssh2?\s*|
+            \s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+connection\s+closed\s+by\s+((invalid\s+user\s+)?(?<username>.+?)\s+)?(?<ipaddress>.+?)\s+port\s+[0-9]+\s+\[preauth\]\s*
           ]]>
         </Regex>