Hi Michael!
First, when using pdbtool for testing, you should specify -P "ssh" on command line, because your rule will only match if the program name is "ssh". Second, be careful with spaces and line breaks!
Patterndb patterns are very sensitive to white spaces and line breaks, if the log is a single line one, then your pattern shouldn't have any line break. In your case, the problem is with spaces.
In patterndb, there is no need to escape spaces, because they are taken literally: one space in the pattern means one space matching in the log. So you should delete the space after the "Accepted" word, and you should
delete an other space and the backslash after "from". With these modifications, I managed to match the line. So here is my pattern:
<?xml version='1.0' encoding='UTF-8'?>
<patterndb version='4' pub_date='2010-10-17'>
<ruleset name='ssh' id='123456678'>
<pattern>ssh</pattern>
<rules>
<rule provider='me' id='182437592347598' class='system'>
<patterns>
<pattern>Accepted@QSTRING:SSH.AUTH_METHOD: @for@QSTRING:SSH_USERNAME: @from@QSTRING:SSH_CLIENT_ADDRESS: @port @NUMBER:SSH_PORT_NUMBER:@ ssh2</pattern>
</patterns>
</rule>
</rules>
</ruleset>
</patterndb>
bin/pdbtool match -p /tmp/test.xml -P "ssh" -M "Accepted password for sampleuser from 10.50.0.247 port 42156 ssh2"