# SPDX-License-Identifier: AGPL-3.0-only
# An IMAP, POP3 or submission login refused:
#   imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<admin@example.net>, method=PLAIN, rip=203.0.113.9, lip=192.0.2.1, TLS, session=<...>
#
# The mailbox name is chosen by whoever is connecting and is printed
# BEFORE the address, so the pattern runs greedily up to the last
# `rip=` on the line — the one dovecot wrote. A user called
# "x, rip=198.51.100.1, lip=" would otherwise frame a bystander.
parser: dovecot-auth-fail
log: mail
prefilter: "auth failed"
regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ dovecot(?:\[\d+\])?: (?P<service>[a-z0-9]+)-login: .*\(auth failed, \d+ attempts[^)]*\)[^:]*: user=<(?P<user>[^>]*)>, method=\S+, rip=(?P<ip>[0-9a-fA-F.:]+), lip='
time_field: time
time_format: syslog
