# SPDX-License-Identifier: AGPL-3.0-only
# An SMTP authentication refused:
#   warning: unknown[203.0.113.9]: SASL LOGIN authentication failed: authentication failure, sasl_username=test@example.net
#   warning: host.example[203.0.113.9]: SASL login authentication failed: ...
#   warning: unknown[203.0.113.9]: SASL NTLM authentication failed: no mechanism available
#
# Postfix writes the mechanism in whatever case it received, so it is
# matched loosely. The address comes from the connection and is printed
# before anything the client chose.
parser: postfix-sasl-fail
log: mail
prefilter: "SASL"
regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ postfix/\S+\[\d+\]: warning: \S*\[(?P<ip>[0-9a-fA-F.:]+)\]: SASL \S+ authentication failed'
time_field: time
time_format: syslog
