The first log line here is not matched as there is no colon after the [sshd]

In [common.conf](https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/common.conf#L33) `__daemon_combs_re` says match (`pid_re` + `daemon_re`) OR (`daemon_re` + `pid_re` followed by a colon)

Suggest either:

1. Make the colon optional with a `?` - at the end of the line before the closing parenthesis
  i.e. `__daemon_combs_re = (?:%(__pid_re)s?:\s+%(__daemon_re)s|%(__daemon_re)s%(__pid_re)s?:?)`
2. Change the test log file to have the colon after [sshd]

However, the log line with the colon missing doesn't seem [very common](http://cloud.zoooot.com/Oj6j) - so maybe option 2 is the best.