diff --git a/files/ssh/etc/filter-syslog/ssh b/files/ssh/etc/filter-syslog/ssh
index 4cf49023f808dcd0cd098b5f4c4dcd7d39f8774b..be19463aa7f0dad548e5b7ec212fcbdd1f035c28 100644
--- a/files/ssh/etc/filter-syslog/ssh
+++ b/files/ssh/etc/filter-syslog/ssh
@@ -32,6 +32,7 @@ sshd: /^Bad protocol version identification 'GET / HTTP/1.1' from UNKNOWN$/
 sshd: /^Connection closed by (UNKNOWN|[:a-f\d.]+)$/
 sshd: /^Did not receive identification string from ([:a-f\d.]+|UNKNOWN)$/
 sshd: /^Protocol major versions differ for ([:a-f\d.]+|UNKNOWN): /
+sshd: /^dispatch_protocol_error: type \d+ seq \d+ \[preauth\]$/
 sshd: /^fatal: Read from socket failed: Connection reset by peer/
 sshd: /^fatal: Timeout before authentication for [:a-f\d.]+$/
 sshd: /^(pam_unix\(sshd:auth\)|\(pam_unix\)):? check pass; user unknown$/