From d01069bd0cc59af6d2bcd6922a4e312b7e8eebc5 Mon Sep 17 00:00:00 2001
From: Russ Allbery <rra@stanford.edu>
Date: Tue, 1 Apr 2014 20:20:11 -0700
Subject: [PATCH] Ignore another variation of ssh port scan errors

---
 files/ssh/etc/filter-syslog/ssh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/files/ssh/etc/filter-syslog/ssh b/files/ssh/etc/filter-syslog/ssh
index 7fb6617..4cf4902 100644
--- a/files/ssh/etc/filter-syslog/ssh
+++ b/files/ssh/etc/filter-syslog/ssh
@@ -32,7 +32,7 @@ sshd: /^Bad protocol version identification 'GET / HTTP/1.1' from UNKNOWN$/
 sshd: /^Connection closed by (UNKNOWN|[:a-f\d.]+)$/
 sshd: /^Did not receive identification string from ([:a-f\d.]+|UNKNOWN)$/
 sshd: /^Protocol major versions differ for ([:a-f\d.]+|UNKNOWN): /
-sshd: /^fatal: Read from socket failed: Connection reset by peer$/
+sshd: /^fatal: Read from socket failed: Connection reset by peer/
 sshd: /^fatal: Timeout before authentication for [:a-f\d.]+$/
 sshd: /^(pam_unix\(sshd:auth\)|\(pam_unix\)):? check pass; user unknown$/
 sshd: /^\(pam_unix\) bad username \[.*\]$/
-- 
GitLab