diff --git a/logwatch-sshd.patch b/logwatch-sshd.patch
new file mode 100644
index 0000000..d97c5e2
--- /dev/null
+++ b/logwatch-sshd.patch
@@ -0,0 +1,26 @@
+From 256829aeb864a25a3542aaacfb2a7ff62b77e7f4 Mon Sep 17 00:00:00 2001
+From: Jan Synacek <jsynacek@redhat.com>
+Date: Tue, 15 Mar 2016 10:29:17 +0100
+Subject: [PATCH] sshd: fix unmatched entries because of the output change in
+ openssh-7.2p2
+
+---
+ scripts/services/sshd | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/services/sshd b/scripts/services/sshd
+index e238863..b94ea5a 100755
+--- a/scripts/services/sshd
++++ b/scripts/services/sshd
+@@ -387,7 +387,7 @@ while (defined(my $ThisLine = <STDIN>)) {
+       $RefusedConnections{$1}++;
+    } elsif ( my ($Reason) = ($ThisLine =~ /^Authentication refused: (.*)$/ ) ) {
+       $RefusedAuthentication{$Reason}++;
+-   } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*): (.*)$/)) {
++   } elsif ( my ($Host,$Reason) = ($ThisLine =~ /^Received disconnect from ([^ ]*) port [^ ]*: (.*)$/)) {
+       # Reason 11 (SSH_DISCONNECT_BY_APPLICATION) is expected, and logged at severity level INFO
+       if ($Reason != 11) {$DisconnectReceived{$Reason}{$Host}++;}
+    } elsif ( my ($Host) = ($ThisLine =~ /^ROOT LOGIN REFUSED FROM ([^ ]*)$/)) {
+-- 
+2.7.2
+
diff --git a/logwatch.spec b/logwatch.spec
index d1afd24..19c7b6f 100644
--- a/logwatch.spec
+++ b/logwatch.spec
@@ -1,7 +1,7 @@
 Summary: A log file analysis program
 Name: logwatch
 Version: 7.4.2
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: MIT
 Group: Applications/System
 URL: http://www.logwatch.org/
@@ -12,6 +12,8 @@ Patch0: logwatch-vsftpd.patch
 # Not applied by upstream.
 Patch1: logwatch-oldfiles.patch
 Patch2: logwatch-secure-userhelper.patch
+# Submitted upstream.
+Patch3: logwatch-sshd.patch
 Requires: textutils sh-utils grep mailx
 Requires: perl(Date::Manip)
 Requires: perl(Sys::CPU)
@@ -30,6 +32,7 @@ of the package on many systems.
 %patch0 -p1
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 rm -f scripts/services/*.orig
 
 %build
@@ -129,6 +132,9 @@ echo "# Configuration overrides for specific logfiles/services may be placed her
 %{_mandir}/man*/*
 
 %changelog
+* Tue Mar 15 2016 Jan Synáček <jsynacek@redhat.com> - 7.4.2-2
+- sshd log format changed, lots of excess unmatched output showing up in logwatch (#1317620)
+
 * Mon Feb 29 2016 Jan Synáček <jsynacek@redhat.com> - 7.4.2-1
 - Update to 7.4.2 (#1312774)