diff --git a/modules/journalwatch.nix b/modules/journalwatch.nix
index b3b0835..c7edf6e 100644
--- a/modules/journalwatch.nix
+++ b/modules/journalwatch.nix
@@ -361,6 +361,7 @@
           error: kex_exchange_identification: Connection closed by remote host
           error: kex_exchange_identification: read: Connection reset by peer
           error: PAM: Authentication failure for \S+ from \S+
+          error: PAM: Authentication failure for illegal user \S+ from \S+
           error: Protocol major versions differ: 2 vs\. 1
           fatal: Timeout before authentication for \S+ port [0-9]+
         '';