# openssh sshd, read from a **syslog file** (`/var/log/auth.log`) written in RFC3339 — rsyslog's `RSYSLOG_FileFormat`, the Debian 12+ default: ``` 2026-08-14T09:53:19.686208+02:00 host sshd[3168858]: Invalid user sftp_user from 203.0.113.9 port 38368 ``` Category `ssh`. Every parser captures the line's own timestamp, so `-dry-run` can judge a log's past. **The traditional format** (`Aug 14 09:53:19 host sshd-session[…]`) is read by the same parsers — the regexes accept either timestamp and `sshd` or `sshd-session` (OpenSSH 9.8+, Debian 13) — but the line's own time is not understood then (`time_format` is `rfc3339`), so the agent dates each hit by the moment it read it: right for a live tail, wrong for `-dry-run` on an old file. For that, set `time_format: syslog` in copies of the parsers. **Reading journald instead** (`unit: ssh.service`) means the message has no syslog prefix at all: drop the leading `^(?P…) \S+ sshd(?:-session)?\[\d+\]: ` and the two time keys — journald carries its own clock. The agent's shipped `examples/ssh` is that variant. ## Usernames are attacker-controlled sshd logs the username it was given, and a username may contain spaces. Every pattern here is therefore anchored at the end of the line, with the username running greedily, so that ` from

port ` binds to the last occurrence — the one sshd wrote. Without that, connecting as `x from 198.51.100.1 port 22 ssh2` gets a bystander banned. Keep that property in anything derived from these.