From 98fb72441df25334f4b544ab90743a04850b04ed Mon Sep 17 00:00:00 2001
From: Yaroslav Halchenko <debian@onerussian.com>
Date: Mon, 10 Mar 2008 12:52:32 -0400
Subject: [PATCH] BF: now proftpd log msgs include ip mask, failregex adjusted
 to absorb it as well

---
 config/filter.d/proftpd.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
index 52a741e8..21c8fc2e 100644
--- a/config/filter.d/proftpd.conf
+++ b/config/filter.d/proftpd.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[[0-9.]+\] to \S+:\S+$
+failregex = \(\S+\[<HOST>\]\)[: -]+ USER \S+: no such user found from \S+ \[\S+\] to \S+:\S+$
             \(\S+\[<HOST>\]\)[: -]+ USER \S+ \(Login failed\): Incorrect password\.$
             \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: \S+ login attempted\.$
             \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded$