SSHD_FORMAT_REGEX = re.compile(r""".*
(sshd.*:|\[sshd\]) (?P<message>.*)""")
should read
SSHD_FORMAT_REGEX = re.compile(r""".*
(sshd.*?:|\[sshd\]) (?P<message>.*)""")
otherwise, if the syslog line contains a colon, it will
consume more than it's supposed to and the line won't
be able to be properly recognised (message won't
include anything before the last colon).