Minor improvement to sshd filter

I'm running OpenSSH (6.6p1, OpenSSL 1.0.1g 7 Apr 2014), loglevel verbose. My logs tend to look like this:

May 18 16:37:34 localhost sshd[758]: Connection from x.x.x.x port 55302 on x.x.x.x port 22
May 18 16:37:35 localhost sshd[758]: Disconnecting: Too many authentication failures for root [preauth]

The current filter will not catch this -- I added a small change that will match the additional info if it exists. Tests pass.