1[auth failure]
2log 1 pass = 2017-01-23 03:44:14 dovecot_login authenticator failed for (hydra) [10.101.1.18]:35686: 535 Incorrect authentication data (set_id=user)
3log 2 pass = 2017-01-24 05:22:29 dovecot_plain authenticator failed for (test) [::1]:39454: 535 Incorrect authentication data (set_id=test)
4
5rule = 13006
6alert = 5
7decoder = windows-date-format
8
9[exim connection]
10log 1 pass = 2017-01-24 03:09:46 SMTP connection from [10.101.1.10]:55010 (TCP/IP connection count = 1)
11
12rule = 13008
13alert = 0
14decoder = windows-date-format
15
16[exim connection lost]
17log 1 pass = 2017-01-24 02:53:13 SMTP connection from (hydra) [10.101.1.10]:53682 lost
18
19rule = 13009
20alert = 1
21decoder = windows-date-format
22
23[exim syntax/protocol error]
24log 1 pass = 2017-01-24 05:36:23 SMTP call from (000000) [::1]:39480 dropped: too many syntax or protocol errors (last command was "123")
25
26rule = 13010
27alert = 5
28decoder = windows-date-format
29
30