|
|
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dovecot: (pop3|imap)-login: Login: user=<.+>, method=.+, rip=[0-9:\.]+, lip=[0-9:\.]+, mpid=[0-9]+, .+, session=<.+>$
|
|
|
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ (dovecot: )?(imap|pop3)-login: Disconnected \((disconnected before greeting, waited|no auth attempts in) [0-9]+ secs\): user=<>, rip=[:.0-9]+, lip=[:.0-9]+, secured, session=<.*>$
|