anacron\[.*\]: Job `cron.(daily|weekly|monthly)' started
anacron\[.*\]: Updated timestamp for job `cron.(daily|weekly|monthly)' to [[:alnum:]-]+
anacron\[.*\]: Job `cron.(daily|weekly|monthly)' terminated( \(mailing output\))?$
anacron\[.*\]: Normal exit \([[:digit:]]+ jobs run\)
anacron\[.*\]: Anacron 2.3 started on [[:alnum:]-]+
anacron\[.*\]: Jobs will be executed sequentially
anacron\[.*\]: Will run job `cron.daily' in 5 min.
anacron\[.*\]: 
anacron\[.*\]: 
anacron\[.*\]: 
named\[.*\]: .*: query\(.*\) NS points to CNAME \(.*\)
dhcpd.*: Abandoning IP address .*: pinged before offer
dhcpd.*: DHCPINFORM from [[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+( via eth.)?
dhcpd.*: DHCPNACK on [\.[:digit:]]+ to [[:alnum:]]+( via eth.)?
dhcpd.*: DHCPRELEASE of .* from .* via
dhcpd.*: Reclaiming( REQUESTed) abandoned IP address [[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+\.
dhcpd.*: already acking lease
dhcpd.*: send_packet: Connection refused
dhcpd.*: fallback_discard: Connection refused
dhcpd: DHCPREQUEST for .* from .* via
dhcpd: DHCPNACK on .* to .* via
dhcpd: DHCPACK on .* to .* via
dhcpd: DHCPDISCOVER from .* via
dhcpd: DHCPOFFER on .* to .* via
dhclient-2.2.x: DHCPREQUEST on .* to .* port 67
dhclient-2.2.x: DHCPDISCOVER on .* to .* port 67 interval [[:digit:]]+
dhclient-2.2.x: No working leases in persistent database - sleeping\.
dhclient-2.2.x: No DHCPOFFERS received\.
dhclient-2.2.x: DHCPOFFER from [\.[:digit:]]+
dhclient-2.2.x: DHCPACK from .*
dhclient-2.2.x: bound to .* -- renewal in [[:digit:]]+ seconds\.
Fax(Getty|Send)\[.*\]: STATE CHANGE:( ->| BASE| LOCKWAIT| LISTENING| RUNNING| ANSWERING| RECEIVING)+
FaxGetty\[.*\]: MODEM (ROCKWELL|ZYXEL) .*
FaxGetty\[.*\]: RECV FAX \([[:digit:]]+\): from .*, page .* in [[:digit:]]+:[[:digit:]]+, INF, .* line/mm, 1-D MR, [[:digit:]]+ bit/s
FaxGetty\[.*\]: RECV FAX \([[:digit:]]+\): recvq/fax[[:digit:]]+\.tif from .*, route to .*, [[:digit:]]+ pages in [[:digit:]]+:[[:digit:]]+
FaxGetty\[.*\]: RECV FAX: bin/faxrcvd "recvq/fax[[:digit:]]+.tif" "ttyS[012]" "[[:digit:]]+" ""
FaxGetty\[.*\]: ANSWER: Ring detected without successful handshake
FaxGetty\[.*\]: ANSWER: FAX CONNECTION
FaxQueuer\[.*\]: SUBMIT JOB [[:digit:]]+
FaxSend[2786]: SEND FAX: JOB [[:digit:]]+ DEST [[:digit:]]+ COMMID [[:digit:]]+
gdm\[.*\]: run_pictures: Directory .* does not exist\.
gnu-imap4d\[.*\]: Incoming connection opened
gnu-imap4d\[.*\]: connect from [\.[:digit:]]+
gnu-imap4d\[.*\]: User '[[:alnum:]]+' logged in
gnu-imap4d\[.*\]: Session timed out for user: [[:alnum:]]+
gnu-imap4d\[.*\]: got signal Alarm clock
HylaFAX\[.*\]: Filesystem has SysV-style file creation semantics.
imapd\[.*\]: (port 143|imap|imaps SSL) service init from
imapd\[.*\]: No route to host, while reading line user=.* host=.*
i(map|pop3)d\[.*\]: Killed \(lost mailbox lock\) user=.* host=.*
i(map|pop3)d\[.*\]: (Login|Auth|Authenticated|Logout|Autologout) user=.* host=.*
i(map|pop3)d\[.*\]: Moved [[:digit:]]+ bytes of new mail to .* from .* host=.*
i(map|pop[2|3])d\[.*\]: (Broken pipe|Command stream end of file|Connection (reset by peer|timed out))(,)? while reading (line|char) user=.* host=.*
ipop[2|3]d\[.*\]: (connect|pop3 service init) from
ipop3d\[.*\]: Trying to get mailbox lock from process [[:digit:]]+
ipop3d\[.*\]: Error opening or locking INBOX user=.* host=.*
ipop3d\[.*\]: Expunge ignored on readonly mailbox
ipop3d\[.*\]: Mailbox is open by another process, access is readonly
ipop3d\[.*\]: Moved .* bytes of new mail to .* from .* host=.*
ircd\[.*\]: ircd exiting: autodie
ircd\[.*\]: Server Ready
(ircd\[.*\]: )?binding stream socket [\.[:alnum:]]+\[\*\.666[789]\]: Address already in use
IMP\[.*\]: Login .* to .*:143 as .*
kernel: Packet log: input DENY eth[[:digit:]]+ PROTO=17 .*:(137|138) .*:(137|138) L=[[:digit:]]+ S=0x00 I=[[:digit:]]+ F=0x0000 T=[[:digit:]]+ \(#[[:digit:]]+\)
named\[.*\]: NSTATS [[:digit:]]+ [[:digit:]]+
named\[.*\]: .* All possible .* lame
ntpd\[.*\]: kern_enable is 1
ntpd\[.*\]: kernel time discipline status 0040
ntpd\[.*\]: ntpd 4\.[01]\..* \([12]\)
ntpd\[.*\]: precision = [[:digit:]]+ usec
ntpd\[.*\]: signal_no_reset: signal 13 had flags [[:digit:]]+
ntpd\[.*\]: using kernel phase-lock loop [[:digit:]]+
postfix.* table has changed -- exiting
postfix/local\[.*\]: warning: unable to create lock file /var/mail/[[:alnum:]]+\.lock: Permission denied
postfix/smtp\[.*\]: .*: to=<.*>, relay=none, delay=[[:digit:]]+, status=deferred \(connect to .*\[.*\]: (Connection refused|server refused mail service)\)
postfix/smtp\[.*\]: connect to .*\[.*\]: (Connection (refused|timed out)|read timeout|server (refused mail service|dropped connection)|No route to host) \(port 25\)
postfix/smtp\[.*\]: warning: numeric domain name in resource data of MX record for .*: [\.[:digit:]]+
postfix/smtp\[.*\]: warning: no MX host for [\.[:alnum:]-]+ has a valid A record
postfix/smtp\[.*\]: warning: host [\.[:alnum:]-]+\[[\.[:digit:]]+\] (greeted me|replied to HELO/EHLO) with my own hostname [\.[:alnum:]-]+
postfix/smtpd\[.*\]: (lost connection|timeout) after [^ ]+ from [\.[:alnum:]-]+\[[\.[:digit:]]+\]
postfix/smtpd\[.*\]: warning: .*: address not listed for hostname .*
postfix/smtpd\[.*\]: warning: .*: hostname [\.[:alnum:]-]+ verification failed: Host (name has no address|not found)
proftpd\[.*\]: .* \(.*\) - FTP session opened\.
proftpd\[.*\]: .* \(.*\) - USER (anonymous|ftp) \(Login failed\): Can't find user\.
pop-before-smtp\[.*\]: (opening|closing) relay for [\.[:digit:]]+( --- not in mynetworks)?
smbd\[.*\]:   read_socket_data: recv failure for 4\. Error = Connection reset by peer
smbd\[.*\]: \[.*\] lib/util_sock.c:read_socket_data\([[:digit:]]+\)
squid\[.*\]:   Finished.  Wrote [[:digit:]]+ entries\.
squid\[.*\]:   Took [[:digit:]]+ seconds \(.* entries/sec\)\.
squid\[.*\]: (access|store)LogRotate: Rotating(\.)?
squid\[.*\]: (Closing Pinger socket|Pinger socket opened) on FD [[:digit:]]+
squid\[.*\]: NETDB state saved;
squid\[.*\]: storeDirWriteCleanLogs: Starting\.\.\.
sshd.*: syslogin_perform_logout: logout\(\) returned an error
sshd.*: Could not reverse map address .*\.
sshd.*: Connection closed by .*
sshd.*: Did not receive ident string from [\.[:digit:]]+
su\[.*\]: \+ pts/[[:digit:]]+ .*-root