failregex = ^%(pid)s \w+ CRAM_MD5_AUTH authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]:25: 535 Incorrect authentication data( \(set_id=.*\))

в логе так

2019-08-30 12:41:58.940 [14209] CRAM_MD5_AUTH authenticator failed for (hosting-by.directwebhost.org.) [45.227.253.116]:47946 I=[xxx.xxx.xxx.xxx]:25: 535 Incorrect authentication data (set_id=akadem.kniga)

как нету есть

Ну не ручками же их каждый раз вписывать

failregex = authenticator failed for (?:[^\[\( ]* )?(?:\(\S*\) )?\[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data \(set_id=.*\).*$

ну пробуй так

Failregex: 100 total
|-  #) [# of hits] regular expression
|   1) [100] authenticator failed for (?:[^\[\( ]* )?(?:\(\S*\) )?\[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data \(set_id=.*\).*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [100] Year(?P<_sep>[-/.])Month(?P=_sep)Day 24hour:Minute:Second(?:,Microseconds)?
`-

Lines: 100 lines, 0 ignored, 100 matched, 0 missed
[processed in 0.02 sec]

а зачем?

Nfr

так

сейчас проверим mainlog

2019-08-30 13:25:03.725 [17321] SMTP protocol error in "AUTH LOGIN" H=(ucceysqik.com) [218.74.75.110]:56039 I=[xxx.xxx.xxx.xxx]:25 LOGIN authentication mechanism not supported

тоже не ловит

failregex = SMTP syntax error in \".+\" H=\[<HOST>\] NULL character\(s\) present \(shown as \'\?\'\)*$
            authenticator failed for (?:[^\[\( ]* )?(?:\(\S*\) )?\[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data \(set_id=.*\).*$
            SMTP protocol error in \"[^"]*\" H=\([^)]*\) \[<HOST>\] \w+ authentication mechanism not supported
            SMTP protocol synchronization error \([^)]*\): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input=".*"\s*$
            %(host_info)srejected RCPT [^@]+@\S+: (?:relay not permitted|Sender verify failed|Unknown user|Unrouteable address)\s*$

все в бан

твое поставить?

4 правила

Failregex: 123 total
|-  #) [# of hits] regular expression
|   9) [123] authenticator failed for (?:[^\[\( ]* )?(?:\(\S*\) )?\[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data \(set_id=.*\).*$

только это попадает

2019-08-30 13:25:03.725 [17321] SMTP protocol error in "AUTH LOGIN" H=(ucceysqik.com) [218.74.75.110]:56039 I=[xxx.xxx.xxx.xxx]:25 LOGIN authentication mechanism not supported