# SPDX-License-Identifier: AGPL-3.0-only
# A connection dropped mid-handshake, before any mail business:
#   lost connection after STARTTLS from scan.example[203.0.113.9]
#   lost connection after EHLO from unknown[203.0.113.9]
#
# TLS scanners and service probes write these; so, rarely, does a
# broken sender — which is why this belongs in a THRESHOLD rule, never
# an instant one. Only the pre-mail stages are matched: a connection
# lost after RCPT or DATA is a network hiccup in real delivery and is
# none of our business.
parser: postfix-starttls-abort
log: mail
prefilter: "lost connection after"
regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ postfix/smtpd\[\d+\]: lost connection after (?:STARTTLS|EHLO|HELO|CONNECT|AUTH|UNKNOWN) from \S+\[(?P<ip>[0-9a-fA-F.:]+)\]$'
time_field: time
time_format: syslog
