--- a/fixbot/logwatch/filters.py	Fri Feb 05 20:38:21 2010 +0200
+++ b/fixbot/logwatch/filters.py	Fri Feb 05 20:38:44 2010 +0200
@@ -103,8 +103,8 @@
 # match accepted ssh logins
 ssh = SimpleFilter(
     "ssh",
-    "Accepted password for (?P<username>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)",
-    "SSH login for %(username)s from %(ip)s:%(port)s"
+    "(?P<hostname>\S+)\s+sshd\[\d+\]:\s*Accepted password for (?P<username>\S+) from (?P<ip>\S+) port (?P<port>\S+) (?P<proto>\S+)",
+    "SSH login for %(username)s@%(hostname)s from %(ip)s:%(port)s"
 )
 
 # drops pam output from cron