PROBLEM: The field "src" is not parsed out for the "Failed password for invalid user" events but "src" is parsed out for the two PAM messages with rhost. If I do a failed login from a valid user account ie "Failed password for xxxxx" then "src" is parsed correctly but there are also no PAM messages with that event with any rhost fields so it seems to work correctly.
Below is a log sample for failed password for invalid user where the src is not parsed at all when PAM messages are also involved in the total login attempt.
Apr 9 14:43:48 test-backup sshd: PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.224.24 << src is parsed
Apr 9 14:43:48 test-backup sshd: Failed password for invalid user april9 from 192.168.224.24 port 36392 ssh2 <