From b91f5ed73994257903b7fc0551eff3095c9b135a Mon Sep 17 00:00:00 2001
From: Jeff Johnson <jjxtra@gmail.com>
Date: Fri, 18 Jan 2019 10:04:34 -0700
Subject: [PATCH] Handle prefix in auth.log

---
 app.config | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app.config b/app.config
index 953228cb..328591dd 100644
--- a/app.config
+++ b/app.config
@@ -35,8 +35,8 @@
         -->
         <Regex>
           <![CDATA[
-            ^\s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+failed\s+password\s+for(\sinvalid\suser)?\s+(?<username>.+?)\s+from\s+(?<ipaddress>.+?)\s+port\s+[0-9]+\s+ssh2?\s*$|
-            ^\s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+connection\s+closed\s+by\s+((invalid\s+user\s+)?(?<username>.+?)\s+)?(?<ipaddress>.+?)\s+port\s+[0-9]+\s+\[preauth\]\s*$
+            \s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+failed\s+password\s+for(\sinvalid\suser)?\s+(?<username>.+?)\s+from\s+(?<ipaddress>.+?)\s+port\s+[0-9]+\s+ssh2?\s*|
+            \s*\w+\s+\w+\s+[0-9:]+\s+\w+\s+sshd.*?\s+connection\s+closed\s+by\s+((invalid\s+user\s+)?(?<username>.+?)\s+)?(?<ipaddress>.+?)\s+port\s+[0-9]+\s+\[preauth\]\s*
           ]]>
         </Regex>