I'm running an SSH daemon in a container with Docker. As the latter is managed by `systemd` and the sshd logs to `stdout`, the relevant data to detect attackers appears in `systemd`'s journal, but its entries have an extra prefix like this:

`Feb 13 21:51:25 my.example.com dockerd[427]: Feb 13 18:51:25 sshd[555]: Invalid user ts3bot from 180.166.17.122 port 43474`

The jail is configured with this snippet:

```
[sshd]

enabled = true
mode    = aggressive
filter  = sshd[mode=%(mode)s]
port    = ssh

```

It seems that this line from `filters.d/sshd.conf` contains what I want to change:

```
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd

```

But I can't find any helpful documentation on `journalmatch`'s configuration. I'm using `fail2ban` 0.10.

Can someone explain how the part on the right of the equal sign is to be interpreted ?

When I hopefully will figure out how to adjust that value, should I edit the `filters.d/sshd.conf` directly (it's provided from an Arch package) or somewhere else?