Reference: http://www.howtoforge.com/forums/showthread.php?t=53938

nveid

2011-08-29 0ea2a52fe228fd482f4cb4ce9440c22b8c37d9da

1
2
3
[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
ignoreregex =