Failregex: 6 total
|-  #) [# of hits] regular expression
|   1) [6] postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+: (EHLO|HELO) we-guess\.mozilla\.org.*$
|      219.80.xx.yy  Sun Jan 14 21:07:13 2018
|      219.80.xx.yy  Sun Jan 14 21:07:13 2018
|      219.80.xx.yy  Thu Jan 25 18:00:14 2018
|      219.80.xx.yy  Thu Jan 25 18:00:14 2018
|      219.80.xx.yy  Thu Jan 25 18:04:32 2018
|      219.80.xx.yy  Thu Jan 25 18:04:32 2018
`-

Ignoreregex: 0 total

HANGUP after [0-9](\.[0-9]|\d+)* from \[<HOST>]:\d+ ?in tests (after|before)

Jan 28 19:44:25 mail postfix/postscreen[7371]: CONNECT from [114.221.126.195]:24729 to [10.10.10.10]:25
Jan 28 19:44:25 mail postfix/postscreen[7371]: PREGREET 12 after 0 from [114.221.126.195]:24729: ehlo hello\r\n
Jan 28 19:44:26 mail postfix/dnsblog[7378]: addr 114.221.126.195 listed by domain zen.spamhaus.org as 127.0.0.11
Jan 28 19:44:26 mail postfix/dnsblog[7378]: addr 114.221.126.195 listed by domain zen.spamhaus.org as 127.0.0.4
Jan 28 19:44:26 mail postfix/postscreen[7371]: DNSBL rank 13 for [114.221.126.195]:24729
Jan 28 19:44:26 mail postfix/postscreen[7371]: COMMAND PIPELINING from [114.221.126.195]:24729 after ehlo: help\r\n\r\n
Jan 28 19:44:26 mail postfix/postscreen[7371]: HANGUP after 0 from [114.221.126.195]:24729 in tests after SMTP handshake
Jan 28 19:44:26 mail postfix/postscreen[7371]: DISCONNECT [114.221.126.195]:24729

[INCLUDES]
before = common.conf

[Definition]
failregex = reject: RCPT from \S+\[<HOST>\]: 450 4.1.8 <\S*>: Sender address rejected: Domain not found; from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
            reject: RCPT from \S+\[<HOST>\]: 450 4.7.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
            reject: RCPT from \S+\[<HOST>\]: 450 4.7.1 Client host rejected: cannot find your reverse hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
            reject: RCPT from \S+\[<HOST>\]: 450 4.7.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
            reject: RCPT from (.*)\[<HOST>\]: 454 4.7.1 Service unavailable.*$
            reject: RCPT from (.*)\[<HOST>\]: 454 4.7.1 (.*): Relay access denied.*$
            reject: RCPT from (.*)\[<HOST>\]: 504 5.5.2 (.*) Helo command rejected: need fully-qualified hostname.*$
            reject: VRFY from (.*)\[<HOST>\]: 550 5.1.1 .*$
            reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1 .*$
            warning: Illegal address syntax from (.*)\[<HOST>\] in (RCPT|MAIL) command.*$
            lost connection after (AUTH|UNKNOWN|EHLO) from (.*)\[<HOST>\].*$
            ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:[ A-Za-z0-9+/:]*={0,2})?\s*$
            ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$


ignoreregex =

[Init]
#backend = polling
##journalmatch = _SYSTEMD_UNIT=postfix.service
#journalmatch =

[INCLUDES]
before = common.conf
[Definition]

failregex =
#先前設定         HANGUP after [0-9]\.[0-9]* from \[<HOST>]:\d+ ?in tests after SMTP handshake$
#先前設定         HANGUP after [0-9]\.[0-9]* from \[<HOST>]:\d+ ?in tests before SMTP handshake$
#          HANGUP after [0-9]\.[0-9]* from \[<HOST>]:\d+ ?in tests (after|before)
           HANGUP after [0-9](\.[0-9]|\d+)* from \[<HOST>]:\d+ ?in tests (after|before)

#          postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+: (EHLO|HELO)
#
#版主設定,放此可抓到          postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+: (EHLO|HELO) we-guess\.mozilla\.org.*$

#先前設定          PREGREET ([0-9]{1,3}) .* from \[<HOST>\]:([0-9]{4,5}:)?(.*) .*$
#先前設定          PREGREET ([0-9]{1,3})* after (0\.[0-9]{1,2}) from \[<HOST>\]:([0-9]{4,5}:)?(.*) .*$


ignoreregex =
#版主設定,抓不到
#ignoreregex = postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+: (EHLO|HELO) we-guess.mozilla.org

[INCLUDES]

# Load regexes for filtering
before = botsearch-common.conf


[Definition]
badbotscustom = EmailCollector|WebEMailExtrac|TrackBack/1\.02|sogou music spider
badbots = Atomic_Email_Hunter/4\.0|atSpider/1\.0|autoemailspider|bwh3_user_agent|China Local Browse 2\.6|ContactBot/0\.2|ContentSmartz|DataCha0s/2\.0|DBrowse 1\.4b|DBrowse 1\.4d|Demo Bot DOT 16b|Demo Bot Z 16b|DSurf15a 01|DSurf15a 71|DSurf15a 81|DSurf15a VA|EBrowse 1\.4b|Educate Search VxB|EmailSiphon|EmailSpider|EmailWolf 1\.00|ESurf15a 15|ExtractorPro|Franklin Locator 1\.8|FSurf15a 01|Full Web Bot 0416B|Full Web Bot 0516B|Full Web Bot 2816B|Guestbook Auto Submitter|Industry Program 1\.0\.x|ISC Systems iRc Search 2\.1|IUPUI Research Bot v 1\.9a|LARBIN-EXPERIMENTAL \(efp@gmx\.net\)|LetsCrawl\.com/1\.0 \+http\://letscrawl\.com/|Lincoln State Web Browser|LMQueueBot/0\.2|LWP\:\:Simple/5\.803|Mac Finder 1\.0\.xx|MFC Foundation Class Library 4\.0|Microsoft URL Control - 6\.00\.8xxx|Missauga Locate 1\.0\.0|Missigua Locator 1\.9|Missouri College Browse|Mizzu Labs 2\.2|Mo College 1\.9|MVAClient|Mozilla/2\.0 \(compatible; NEWT ActiveX; Win32\)|Mozilla/3\.0 \(compatible; Indy Library\)|Mozilla/3\.0 \(compatible; scan4mail \(advanced version\) http\://www\.peterspages\.net/?scan4mail\)|Mozilla/4\.0 \(compatible; Advanced Email Extractor v2\.xx\)|Mozilla/4\.0 \(compatible; Iplexx Spider/1\.0 http\://www\.iplexx\.at\)|Mozilla/4\.0 \(compatible; MSIE 5\.0; Windows NT; DigExt; DTS Agent|Mozilla/4\.0 efp@gmx\.net|Mozilla/5\.0 \(Version\: xxxx Type\:xx\)|NameOfAgent \(CMS Spider\)|NASA Search 1\.0|Nsauditor/1\.x|PBrowse 1\.4b|PEval 1\.4b|Poirot|Port Huron Labs|Production Bot 0116B|Production Bot 2016B|Production Bot DOT 3016B|Program Shareware 1\.0\.2|PSurf15a 11|PSurf15a 51|PSurf15a VA|psycheclone|RSurf15a 41|RSurf15a 51|RSurf15a 81|searchbot admin@google\.com|ShablastBot 1\.0|snap\.com beta crawler v0|Snapbot/1\.0|Snapbot/1\.0 \(Snap Shots, \+http\://www\.snap\.com\)|sogou develop spider|Sogou Orion spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sogou spider|Sogou web spider/3\.0\(\+http\://www\.sogou\.com/docs/help/webmasters\.htm#07\)|sohu agent|SSurf15a 11 |TSurf15a 11|Under the Rainbow 2\.2|User-Agent\: Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1\)|VadixBot|WebVulnCrawl\.unknown/1\.0 libwww-perl/5\.803|Wells Search II|WEP Search 00

failregex = ^<HOST> -.*"(GET|POST|HEAD).*HTTP.*"(?:%(badbots)s|%(badbotscustom)s)"$
            ^<HOST> -.*GET http.*
            ^<HOST> .*\"(\\\S|\\)x\d\d\\.*\" 400 .+$
            ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) .*\" 404 .+$
            ^<HOST> .*\"POST .*\" 405 .+$
            ^<HOST> -.*GET.*(\.asp|\.aspx|\.aspix|\.exe|\.cgi|\scgi)

            ^ \[error\] \d+#\d+: \*\d+ no user/password was provided for basic authentication, client: <HOST>, server: \S+, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"\s*$
            ^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) .*?$

             ^ \[error\] \d+#\d+: \*\d+ .*?forbidden(\,| .*) client: <HOST>

             ^ \[error\] \d+#\d+: \*\d+ ?FastCGI sent in stderr: .*?client: <HOST>

ignoreregex =

[Init]
backend = polling
journalmatch =

[nginx-http-auth]
enabled         = true
port            = http,https
#logpath        = %(nginx_error_log)s
logpath         = %(nginx_log)s 

nginx_log = %(syslog_nginx)s
nginx_backend = %(default_backend)s

syslog_nginx = /var/log/nginx/*.log

Lines: 162118 lines, 8 ignored, 256 matched, 161854 missed
[processed in 17.75 sec]

|- Ignored line(s):
|  Jan 14 21:07:13 mail postfix/postscreen[18432]: PREGREET 33 after 0.21 from [219.80.xx.yy]:13685: EHLO we-guess.mozilla.org\r\nQUIT\r\n
|  Jan 14 21:07:13 mail postfix/postscreen[18432]: PREGREET 33 after 0.21 from [219.80.xx.yy]:13687: EHLO we-guess.mozilla.org\r\nQUIT\r\n
|  Jan 25 18:00:14 mail postfix/postscreen[13076]: PREGREET 33 after 0.04 from [219.80.xx.yy]:55933: EHLO we-guess.mozilla.org\r\nQUIT\r\n
|  Jan 25 18:00:14 mail postfix/postscreen[13076]: PREGREET 27 after 0.04 from [219.80.xx.yy]:35427: EHLO we-guess.mozilla.org\r\n
|  Jan 25 18:04:32 mail postfix/postscreen[13246]: PREGREET 33 after 0.11 from [219.80.xx.yy]:15135: EHLO we-guess.mozilla.org\r\nQUIT\r\n
|  Jan 25 18:04:32 mail postfix/postscreen[13246]: PREGREET 33 after 0.11 from [219.80.xx.yy]:64281: EHLO we-guess.mozilla.org\r\nQUIT\r\n
|  Jan 29 10:35:17 mail postfix/postscreen[22871]: PREGREET 33 after 0.03 from [192.168.1.10]:1885: EHLO we-guess.mozilla.org\r\nQUIT\r\n
|  Jan 29 10:35:17 mail postfix/postscreen[22871]: PREGREET 33 after 0.02 from [192.168.1.10]:1887: EHLO we-guess.mozilla.org\r\nQUIT\r\n
`-