#Mar 11 16:25:32 nada saslauthd[1732]: do_auth         : auth failure: [user=no-reply] [service=smtp] [realm=] [mech=shadow] [reason=Unknown]
#Mar 11 16:27:11 nada saslauthd[1732]: do_auth         : auth failure: [user=Dr_Gonzo] [service=smtp] [realm=Challenge-UK.com] [mech=shadow] [reason=Unknown]
#Apr 13 09:42:29 kvarnen saslauthd[620]: do_auth         : auth failure: [user=test] [service=] [realm=] [mech=pam] [reason=PAM auth error]
#Apr 15 19:27:33 nada saslauthd[1732]: do_auth         : auth failure: [user=backuppc ] [service=smtp] [realm=wahlberg.se] [mech=shadow] [reason=Unknown]
#Apr  2 16:58:34 nada saslauthd[619]: do_auth         : auth failure: [user=prueba] [service=smtp] [realm=] [mech=shadow] [reason=Invalid username]
#Apr  2 19:08:45 nada saslauthd[604]: do_auth         : auth failure: [user=backup] [service=smtp] [realm=] [mech=shadow] [reason=Incorrect password]
#Feb  6 02:20:14 nada saslauthd[610]: do_auth         : auth failure: [user=Adm1n!] [service=smtp] [realm=#] [mech=shadow] [reason=Invalid username]
#Oct 25 11:21:07 nada saslauthd[276]:                 : auth failure: [user=sales] [service=smtp] [realm=] [mech=shadow] [reason=Invalid username]

^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saslauthd\[[[:digit:]]+\]: (do_auth)?[[:blank:]]+: auth failure: \[user=([[:print:]]+)?\] \[service=(smtp)?\] \[realm=([[:print:]]+)?\] \[mech=(pam|shadow)\] \[reason=(Unknown|PAM auth error|Invalid username|Incorrect password)\]

#Oct 26 09:44:50 nada saslauthd[275]:                 : NULL password received
^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ saslauthd\[[[:digit:]]+\]: (do_auth)?[[:blank:]]+: NULL password received