diff --git a/logwatch-failed-login.patch b/logwatch-failed-login.patch
new file mode 100644
index 0000000..a7cd5be
--- /dev/null
+++ b/logwatch-failed-login.patch
@@ -0,0 +1,20 @@
+--- a/scripts/services/sshd	2022/01/20 15:28:35	1.1
++++ b/scripts/services/sshd	2022/01/20 15:32:01
+@@ -1,3 +1,5 @@
++#!/usr/bin/env perl
++
+ ##########################################################################
+ # $Id$
+ ##########################################################################
+@@ -376,6 +378,11 @@
+          print STDERR "DEBUG: Found -Failed login- line\n";
+       }
+       $BadLogins{$Host}{"$User/$Method"}++;
++   } elsif ( my ($User,$Host) = ( $ThisLine =~ m/^Disconnected from authenticating user (\S+) (\S+) / ) ) {
++      if ( $Debug >= 5 ) {
++         print STDERR "DEBUG: Found -Disconnected Failed login- line\n";
++      }
++      $BadLogins{$Host}{$User}++;
+    } elsif ($ThisLine =~ s/^(log: )?Could not reverse map address ([^ ]*).*$/$2/) {
+       $NoRevMap{$ThisLine}++;
+    } elsif ( my ($Address) = ($ThisLine =~ /^reverse mapping checking getaddrinfo for (\S+( \[\S+\])?) failed - POSSIBLE BREAK-IN ATTEMPT!/)) {
diff --git a/logwatch.spec b/logwatch.spec
index 96f8cd1..5f6a773 100644
--- a/logwatch.spec
+++ b/logwatch.spec
@@ -1,7 +1,7 @@
 Summary: A log file analysis program
 Name: logwatch
 Version: 7.4.3
-Release: 12%{?dist}
+Release: 13%{?dist}
 License: MIT
 Group: Applications/System
 URL: http://www.logwatch.org/
@@ -25,6 +25,7 @@ Patch7: logwatch-sshd-2.patch
 # cherry-pick hunk at @@ -224,7 +224,7 @@
 Patch8: logwatch-dovecot.patch
 Patch9: logwatch-pam-unix.patch
+Patch10: logwatch-failed-login.patch
 
 BuildRequires: perl-generators
 Requires: grep mailx
@@ -52,6 +53,7 @@ of the package on many systems.
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
+%patch10 -p1
 rm -f scripts/services/*.orig
 
 %build
@@ -151,6 +153,10 @@ echo "# Configuration overrides for specific logfiles/services may be placed her
 %{_mandir}/man*/*
 
 %changelog
+* Thu Apr 20 2023 Pavel Šimovec <psimovec@redhat.com> - 7.4.3-13
+- fix unrecognized "Disconnected from authenticating user" failed logins
+- Resolves: rhbz#2043088
+
 * Thu Apr 20 2023 Pavel Šimovec <psimovec@redhat.com> - 7.4.3-12
 - add logwatch-pam-unix.patch
 - Resolves: rhbz#2043044