Need the following two rules for FC4:

"SSHD-Invalid": re.compile(r"""sshd\[\d+\]: Invalid user (?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"""),

"SSHD-AllowUser": re.compile(r"""sshd\[\d+\]: User (?P.*?) from (::ffff:)?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) not allowed because not listed in AllowUsers"""),

Note that I only permit specific accounts to log in via keys.

Fixed in release 1.0.1

See details in the 1.0.1 CHANGES file, or read about it in the comment to this forum posting:
Not picking up failed attempts