--- config/filter.d/sshd.conf	2007-06-05 22:00:24.000000000 +0200
+++ config/filter.d/sshd.conf	2007-06-05 22:00:41.000000000 +0200
@@ -14,10 +14,10 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = Authentication failure for .* from <HOST>
-            Failed [-/\w]+ for .* from <HOST>
-            ROOT LOGIN REFUSED .* FROM <HOST>
-            [iI](?:llegal|nvalid) user .* from <HOST>
+failregex = Authentication failure for .* from <HOST>$
+            Failed [-/\w]+ for .* from <HOST>$
+            ROOT LOGIN REFUSED .* FROM <HOST>$
+            [iI](?:llegal|nvalid) user .* from <HOST>$

 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.