In fact for journald mode internally it really is type ABSOLUTE, because
we use journald cursor to get only new logs on each collect. It results
in the same value as with a plain log file and type DERIVE: it's the
rate of events.
type=DERIVE is best for servers with lots of ssh traffic.
Now shows the number of events per time unit, instead of a counter
always increasing until logrotate.
To use journald, set env.logfile to special value 'journald': It will
read the sshd logs from journalctl _COMM=sshd.
To configure the source of journald, set env.journalctlarg:
Example: "env.journalctlarg --unit=sshd.service"
