1234567 |
- ^\w{3} {11} + dovecot: (pop3|imap|managesieve)-login: Login: user=<.+>, method=.+, rip=+, lip=+, mpid=+, .+, session=<.+>$
- ^\w{3} {11} + dovecot: (pop3|imap|managesieve)\(.*\): (Connection closed|Disconnected: Logged out) in=+ out=+$
- ^\w{3} {11} + (dovecot: )?(imap|pop3|managesieve)-login: (Disconnected|Aborted login) \((disconnected before greeting, waited|no auth attempts in) + secs\): user=<>, rip=+, lip=+, ((secured|TLS), )?session=<.*>$
- ^\w{3} {11} + dovecot: auth: Warning: auth client + disconnected with + pending requests: (Connection reset by peer|EOF)$
- ^\w{3} {11} + dovecot: (imap|pop3|managesieve)-login: (Disconnected|Aborted login) \(auth failed, + attempts in + secs\): user=<.+>, method=.+, rip=+, lip=+, session=<.*>$
- ^\w{3} {11} + dovecot: auth-worker\(+\): mysql\(.+\): Connected to database .+$
- ^\w{3} {11} + dovecot: (imap|pop3|managesieve)\(.+\): (Disconnected(:| for inactivity|: Logged out|: Disconnected in IDLE)|Connection closed(:|: Connection reset by peer)) in=+ out=+$
|