diff --git a/logwatch-sshd.patch b/logwatch-sshd.patch
new file mode 100644
index 0000000..3a05ce1
--- /dev/null
+++ b/logwatch-sshd.patch
@@ -0,0 +1,10 @@
+--- logwatch-svn50.dist/scripts/services/sshd	2011-01-07 09:16:39.000000000 +1100
++++ logwatch-svn50/scripts/services/sshd	2011-04-30 23:30:48.000000000 +1000
+@@ -285,6 +285,7 @@
+        ($ThisLine =~ /pam_succeed_if\(.*:.*\): error retrieving information about user [a-zA-Z]*/ ) or
+        ($ThisLine =~ /pam_winbind\(sshd:account\): user .* granted access/) or
+        ($ThisLine =~ /pam_winbind\(sshd:account\): user .* OK/) or
++       ($ThisLine =~ /pam_systemd\(sshd:session\): Moving/) or
+        ($ThisLine =~ /PAM \d+ more authentication failures?;/) or
+        ($ThisLine =~ /^Failed keyboard-interactive for <invalid username> from/ ) or
+        ($ThisLine =~ /^Keyboard-interactive \(PAM\) userauth failed/ ) or