^\w{3} [ :0-9]{11} [._[:alnum:]-]+ dovecot-auth: \(pam_unix\) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=[^[:space:]]* rhost=127\.0\.0\.1  user=[^[:space:]]*$