diff --git a/logcheck_ubuntu b/logcheck_ubuntu
index 69f3894..92303d2 100644
--- a/logcheck_ubuntu
+++ b/logcheck_ubuntu
@@ -106,7 +106,11 @@
 
 #Mar  2 17:00:24 marconi sshd[556]: Connection reset by 119.147.115.37 port 1841 [preauth]
 #Mar  2 17:07:35 marconi sshd[2635]: Connection reset by 119.147.115.37 port 1070 [preauth]
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection reset by [.:[:digit:]]+ port [.:[:digit:]]+ \[preauth\]
+#Nov 13 10:02:01 marconi sshd[675]: Connection reset by authenticating user root 27.148.158.148 port 3403 [preauth]
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Connection reset by( authenticating user [[:alnum:]]+)? [.:[:digit:]]+ port [.:[:digit:]]+ \[preauth\]
+
+
+
 
 #Mar  2 17:04:13 marconi sshd[1368]: Disconnecting: Too many authentication failures [preauth]
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ sshd\[[[:digit:]]+\]: Disconnecting: Too many authentication failures \[preauth\]
diff --git a/testlog b/testlog
index bf497c7..5f8daba 100644
--- a/testlog
+++ b/testlog
@@ -617,6 +617,7 @@ Nov  7 10:35:56 marconi 50-motd-news[31369]:    base images
 Nov  7 10:35:56 marconi 50-motd-news[31369]:    - https://ubu.one/u1710
 Nov  7 10:50:46 marconi sshd[3881]: Unable to negotiate with 173.255.227.186 port 51816: no matching host key type found. Their offer: ssh-dss [preauth]
 Nov 13 06:05:46 marconi nmbd[5134]:   Packet send failed to 172.18.255.255(138) ERRNO=Ogiltigt argument
+Nov 13 10:02:01 marconi sshd[675]: Connection reset by authenticating user root 27.148.158.148 port 3403 [preauth]
 
 
 Aug 23 18:39:24 nada fredrik[1713]: Kontrollrad. Syns detta har vi problem...