Index: trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl
===================================================================
--- trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 2094)
+++ trunk/server/fedora/config/etc/syslog-ng/d_zroot.pl	(revision 2095)
@@ -122,4 +122,5 @@
 	} elsif ($message =~ m|^error: PAM: Authentication failure|) {
 	} elsif ($message =~ m|^pam_unix\(sshd:auth\): authentication failure|) {
+	} elsif ($message =~ m|^pam_unix\(sshd:auth\): check pass; user unknown|) {
 	} elsif ($message =~ m|^Postponed keyboard-interactive for invalid user |) {
 	} elsif ($message =~ m|^Failed keyboard-interactive/pam for invalid user |) {