update rules

8 files changed, 208 insertions, 84 deletions

diff --git a/files/etc/logcheck/ignore.d.server/local-chrony b/files/etc/logcheck/ignore.d.server/local-chrony
index 5a0f4c3..e37c5cc 100644
--- a/files/etc/logcheck/ignore.d.server/local-chrony
+++ b/files/etc/logcheck/ignore.d.server/local-chrony
@@ -1,6 +1,6 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: chronyd exiting$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: chronyd version 4\.0 starting \(\+CMDMON \+NTP \+REFCLOCK \+RTC \+PRIVDROP \+SCFILTER \+SIGND \+ASYNCDNS \+NTS \+SECHASH \+IPV6 -DEBUG\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Frequency -[[:digit:].]+ +/- [[:digit:].]+ ppm read from /var/lib/chrony/chrony\.drift$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Frequency -[[:digit:].]+ \+/- [[:digit:].]+ ppm read from /var/lib/chrony/chrony\.drift$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Loaded seccomp filter$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Selected source [[:xdigit:]:.]+( \([[:alnum:].:]+\))?$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ chronyd\[[[:digit:]]+\]: Source [[:xdigit:]:.]+ (online|offline)$
diff --git a/files/etc/logcheck/ignore.d.server/local-dhcpcd b/files/etc/logcheck/ignore.d.server/local-dhcpcd
index 772da05..2b8e904 100644
--- a/files/etc/logcheck/ignore.d.server/local-dhcpcd
+++ b/files/etc/logcheck/ignore.d.server/local-dhcpcd
@@ -4,8 +4,11 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding IP address [[:digit:].]+/[[:digit:]]{1,2}$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: adding route to [[:digit:].]+/[[:digit:]]{1,2} metric 0$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: leased [[:digit:].]+ for [[:digit:]]+ seconds$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: removing interface$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: removing route to [[:digit:].]+/[[:digit:]]{1,2} metric 0$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renew in [[:digit:]]+, rebind in [[:digit:]]+, expire in [[:digit:]]+ seconds$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: renewing lease of [[:digit:].]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: [[:alnum:]]+: REPLY6 received from [[:xdigit:]:]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: dhcpcd exited$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd\[[[:digit:]]+\]: received SIGTERM, stopping$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dhcpcd.sh: interface [[:alnum:]]+ has been configured with old IP=[[:digit:].]+$
diff --git a/files/etc/logcheck/ignore.d.server/local-dnsmasq b/files/etc/logcheck/ignore.d.server/local-dnsmasq
index 0246b42..6083ba5 100644
--- a/files/etc/logcheck/ignore.d.server/local-dnsmasq
+++ b/files/etc/logcheck/ignore.d.server/local-dnsmasq
@@ -1,7 +1,12 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPADVERTISE\([[:alnum:]-]+\) [[:xdigit:]:]+ [[:xdigit:]:]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPCONFIRM\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCP, IP range [[:digit:].]+ -- [[:digit:].]+, lease time 1h$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPRENEW\([[:alnum:]-]+\) [[:xdigit:]:]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPREPLY\([[:alnum:]-]+\) [[:xdigit:]:]+ [[:xdigit:]:]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCP, sockets bound exclusively to interface [[:alnum:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: DHCPSOLICIT\([[:alnum:]-]+\) [[:xdigit:]:]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: RTR-ADVERT\([[:alnum:]-]+\) [[:xdigit:]:]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq-dhcp\[[[:digit:]]+\]: RTR-SOLICIT\([[:alnum:]-]+\) [[:xdigit:]:]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset auth cryptohash DNSSEC loop-detect inotify dumpfile$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: started, version 2\.85 cachesize 150$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ dnsmasq\[[[:digit:]]+\]: using nameserver [[:xdigit:].:]+#53$
diff --git a/files/etc/logcheck/ignore.d.server/local-exim b/files/etc/logcheck/ignore.d.server/local-exim
index 472f1e1..e2b4bca 100644
--- a/files/etc/logcheck/ignore.d.server/local-exim
+++ b/files/etc/logcheck/ignore.d.server/local-exim
@@ -1,44 +1,121 @@
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Scoring: Rejected message from [^[:space:]]+ to [^[:space:]]+ via \[[[:xdigit:].:]+\]: rspamd-score is: -![[:digit:].]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Scoring: Summarized score is -?[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Tarpit: Delaying connection after DATA for [^[:space:]]+ in MAIL FROM [^[:space:]]+ for -?[[:digit:]]s due to domain score factor: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Tarpit: Delaying connection after DATA for [^[:space:]]+ in MAIL FROM [^[:space:]]+ for -?[[:digit:]]s due to inconsistent setup: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Tarpit: Delaying connection after DATA for [^[:space:]]+ in MAIL FROM [^[:space:]]+ for -?[[:digit:]]s due to IP DNSBL score: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Tarpit: Delaying connection after DATA for [^[:space:]]+ in MAIL FROM [^[:space:]]+ for -?[[:digit:]]s due to rspamd score: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Antispam_Tarpit: Delaying connection after DATA for [^[:space:]]+ in MAIL FROM [^[:space:]]+ for -?[[:digit:]]s due to spamassassin score: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} Completed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} <= [^[:digit:]]+ H=[^[:digit:]]+ \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps X=[^[:space:]]+ CV=no S=[[:digit:]]+ DKIM=[^[:space:]]+ id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} <= [^[:space:]]+ H=[^[:space:]]+ \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtp S=[[:digit:]]+ id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-domain-score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-inconsistency-score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-ip-score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-rSpam_bar: [/+-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-rSpam_report: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-rSpam_score: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-rSpam_score_int: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-Spam_bar: [/+-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-Spam_score: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2} X-hnjs-Spam_score_int: -?[[:digit:].]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Blacklists: IP \[[[:xdigit:].:]+\] is blacklisted at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Check: reverse DNS host lookup failed$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after connect from IP \[[[:xdigit:].:]+\] for [[:digit:]]+s due to inconsistent setup: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after connect from IP \[[[:xdigit:].:]+\] for [[:digit:]]+s due to IP DNSBL score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after HELO [^[:space:]]+ from IP \[[[:xdigit:].:]+\] for [[:digit:]]+s due to inconsistent setup: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after HELO [^[:space:]]+ from IP \[[[:xdigit:].:]+\] for [[:digit:]]+s due to IP DNSBL score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after MAIL FROM [^[:space:]]+ for [[:digit:]]+s due to domain score factor: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after MAIL FROM [^[:space:]]+ for [[:digit:]]+s due to inconsistent setup: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after MAIL FROM [^[:space:]]+ for [[:digit:]]+s due to IP DNSBL score: [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after RCPT TO [^[:space:]]+ for MAIL FROM [^[:space:]]+ for [[:digit:]-]s due to domain score factor: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after RCPT TO [^[:space:]]+ for MAIL FROM [^[:space:]]+ for [[:digit:]-]s due to inconsistent setup: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Tarpit: Delaying connection after RCPT TO [^[:space:]]+ for MAIL FROM [^[:space:]]+ for [[:digit:]-]s due to IP DNSBL score: [[:digit:]-]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Antispam_Whitelists: IP \[[[:xdigit:].:]+\] is whitelisted at .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Connection closed without quit after message from [^[:space:]]+ to @ via \[[[:xdigit:].:]+\]: connection-lost$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? End queue run: pid=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? exim [[:digit:].]+ daemon started: pid=[[:digit:].]+, -q30m, listening for SMTP on port 25 \(IPv6 and IPv4\) port 587 \(IPv6 and IPv4\) and for SMTPS on port 465 \(IPv6 and IPv4\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? no host name found for IP address [[:xdigit:].:]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? no MAIL in SMTP connection from [^[:space:]]+ ([^[:space:]]+) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ D=[[:digit:]]+s( X=[^[:space:]]+ CV=no)?( C=(EHLO,STARTTLS,)?EHLO,QUIT)?$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? no MAIL in SMTP connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ D=[[:digit:]]+s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? SMTP connection from [^[:space:]]+ \([^[:space:]]+\) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by QUIT$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? SMTP connection from \[[[:xdigit:].:-]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost D=[[:digit:]]+s$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? SMTP connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \(TCP/IP connection count = [[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1/[[:digit:]]\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} \[[[:digit:]]+\])? Start queue run: pid=[[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]: \[[2-9]/[[:digit:]]+\] .*$
+#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antiabuse_Scoring: rejected AUTH for [[:xdigit:].:]+ on port [[:digit:]]+ due to DNSBL IP score: [[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Blacklists: domain [[:alnum:].-]+ is blacklisted at .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Accepted MAIL FROM.*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Accepted RCPT TO [^[:space:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Blacklists: IP [[:xdigit:].:]+ is blacklisted at .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Check: reverse DNS host lookup failed$
+#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to DNSBL IP score: [[:digit:]]+$
+#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to rspamd score: [[:digit:].]+$
+#^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Rejecting message from [^[:space:]]+ to [^[:space:]]+ via [[:xdigit:].:]+ due to spamassassin score: [[:digit:].]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Scoring: Summarized score is -?[[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit: NOT delaying connection due to host [[:xdigit:].:]+ being on a whitelist$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit: NOT delaying connection due to sender being authenticated$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after AUTH for [[:digit:]]+s due to inconsistent setup score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after AUTH for [[:digit:]]+s due to IP DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after connect for [[:digit:]]+s due to inconsistent setup score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after connect for [[:digit:]]+s due to IP DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to domain DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to inconsistent setup score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for [[:digit:]]+s due to IP DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for -?[[:digit:]]+s due to rspamd score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after DATA for -?[[:digit:]]+s due to spamassassin score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after HELO [^[:space:]]+ for [[:digit:]]+s due to inconsistent setup score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after HELO [^[:space:]]+ for [[:digit:]]+s due to IP DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to domain DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to inconsistent setup score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after MAIL FROM [^[:space:]]* for [[:digit:]]+s due to IP DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to domain DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to inconsistent setup score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Tarpit:( NOT delaying| Delaying) connection from [[:xdigit:].:]+ after RCPT TO [^[:space:]]* for [[:digit:]]+s due to IP DNSBL score$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Whitelists: domain [[:alnum:].-]+ is whitelisted at .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Antispam_Whitelists: IP [[:xdigit:].:]+ is whitelisted at .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? AUTH allowed for [[:xdigit:].:]+ on port [[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? AUTH requested from [[:xdigit:].:]+ on port (587|465)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Completed$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: bad-commands
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: command-timeout$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: connection-lost$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Connection closed without quit after message from [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: tls-failed$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? DKIM: d=[^[:space:]]+ s=[^[:space:]]+ \[failed key import\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? DKIM: validation error: Public key signature verification has failed\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: header syntax \(missing or malformed local part: failing address in "(From:|To:)" header is: .*\): missing or malformed local part: failing address in "(From:|To:)" header is: .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: header syntax \(unqualified address not permitted: failing address in "(From:|To:)" header is: .*\): unqualified address not permitted: failing address in "(From:|To:)" header is: .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected after DATA: Rejected due to site policy reasons\. Contact postmaster in case of problems\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\](:[[:digit:]]+)? TLS error on connection \(recv\): Error in the pull function\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\](:[[:digit:]]+)? TLS error on connection \(recv\): The TLS connection was non-properly terminated\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? PRDR R=<[^[:space:]]+> acceptance$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? Running acl_[^[:space:]]+ for (IP [[:xdigit:].:]+|domain [[:alnum:].-]+|user [[:alnum:]-]+)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? SMTP connection lost after final dot H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\] I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? SMTP connection lost after final dot [^[:space:]]* to @ via \[[[:xdigit:].:]+\]: tls-failed$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtpsa X=[^[:space:]]+ CV=(no|yes)( SNI=[^[:space:]]+)? A=(dovecot_plain|dovecot_login):[[:alnum:]:@.]+( PRDR)? S=[[:digit:]]+ id=[^[:space:]]+ from <[^[:space:]]+> for .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtp S=[[:digit:]]+( DKIM=[^[:space:]]+)? id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ P=esmtps X=[^[:space:]]+ CV=(no|yes)( SNI=[^[:space:]]+)? S=[[:digit:]]+( DKIM=[^[:space:]]+)? id=[^[:space:]]+ from <[^[:space:]]+> for [^[:space:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? == [^[:space:]]+ routing defer \(-52\): retry time not reached$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? == [^[:space:]]+ R=[^[:space:]]+ T=[^[:space:]]+ defer \(-53\): retry time not yet reached$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? => [^[:space:]]+( <[^[:space:]]+>)? F=<[^[:space:]]+> P=<[^[:space:]]+> R=dnslookup T=remote_smtp H=[[:alnum:].-]+ \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ X=[^[:space:]]+ CV=(no|yes) DN="[^"]+"( K)? C="[^"]+"$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? => [^[:space:]]+( <[^[:space:]]+>)? F=<[^[:space:]]+> P=<[^[:space:]]+> R=local_user T=deliver_pipe$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? <= [^[:space:]]+ U=[[:alnum:]]+ P=local S=[[:digit:]]+( id=[^[:space:]]+)? from <[^[:space:]]+> for .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? TLS error on connection from( [^[:space:]]+| \([^[:space:]]+\)| [^[:space:]]+ \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): The TLS connection was non-properly terminated\.(: syscall: Connection reset by peer)?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-domain-score: [[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-inconsistency-score: [[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-ip-score: [[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_bar: [/+-]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_report: .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_score: -?[[:digit:].]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-rSpam_score_int: -?[[:digit:].]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_bar: [/+-]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_report: .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_score: -?[[:digit:].]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])?( [[:alnum:]]{6}-[[:alnum:]]{6}-[[:alnum:]]{2})? X-hnjs-Spam_score_int: -?[[:digit:].]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? Connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ refused: too many connections from that IP address$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? (dovecot_login|dovecot_plain) authenticator failed for ([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+: 535 Incorrect authentication data( \(set_id=[[:alnum:]_@.-]+\))?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? End queue run: pid=[[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? exim [[:digit:].]+ daemon started: pid=[[:digit:].]+, -q30m, listening for SMTP on port 25 \(IPv6 and IPv4\) port 587 \(IPv6 and IPv4\) and for SMTPS on port 465 \(IPv6 and IPv4\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(connection lost\) from <[^[:space:]]+>( for .*)?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(QUIT\) from <[^[:space:]]+>$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ incomplete transaction \(RSET\) from <[^[:space:]]+>( for [^[:space:]]+)?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify defer for <[^[:space:]]+>: host lookup did not complete$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify defer for <[^[:space:]]+>: remote host address is the local host$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: all relevant MX records point to non-existent hosts$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: host lookup did not complete$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ sender verify fail for <[^[:space:]]+>: Unrouteable address$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-])? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Rejected due to site policy reasons\. Contact postmaster in case of problems\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Rejected for too many bad recipients$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: relay not permitted$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Sender verify failed$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: SPF check failed\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> rejected RCPT <[^[:space:]]+>: Unrouteable address$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? F=<[^[:space:]]*> temporarily rejected RCPT <[^[:space:]]+>: Could not complete sender verify$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( X=[^[:space:]]+ CV=(no|yes))?( SNI=[[:alnum:].-]+)? rejected AUTH (LOGIN|PLAIN): Rejected AUTH due to site policy reasons\. Disable SMTP AUTH and contact postmaster in case of problems\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? H=\[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ Warning: ACL "warn" statement skipped: condition test deferred: host lookup deferred for reverse lookup check$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? no host name found for IP address [[:xdigit:].:]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? no MAIL in SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( D=([[:digit:]]+[ms])+)?( X=[^[:space:]]+ CV=no)?( SNI=[^[:space:]]+)?( C=(HELO|EHLO|STARTTLS|AUTH|QUIT|RSET|HELP|,)+)?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? rejected (EHLO|HELO) from( [^[:space:]]+)? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+: syntactically invalid argument\(s\): \(no argument given\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? REJECT \[[[:xdigit:].:]+\]: bad recipient count high \[[[:digit:]]+\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? remote host address is the local host: [^[:space:]]+ \(while verifying <[^[:space:]]+> from host \([^[:space:]]+\) \[[[:xdigit:].:]+\]:[[:digit:]]+\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? Reverse DNS lookup failed for \[[[:xdigit:].:]+\] \((failed|deferred)\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP call from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ dropped: too many syntax or protocol errors .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP call from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ dropped: too many unrecognized commands .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP command timeout on( TLS)? connection from( [^[:space:]]+| \([^[:space:]]+\)| [^[:space:]]+ \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by EOF$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ closed by QUIT$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost( \(error: Connection reset by peer\))? D=([[:digit:]]+[ms])+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ lost while reading message data( \(header\))?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP connection from \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \(TCP/IP connection count = [[:digit:]]+\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP protocol error in "[^"]*" H=([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\))( \[[[:xdigit:].:]+\]:[[:digit:]]+)? I=\[[[:xdigit:].:]+\]:[[:digit:]]+ .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? SMTP syntax error in ".*" H=([^[:space:]]+ )?\[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ .*$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? Start queue run: pid=[[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A disallowed SNI server name has been received\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): An unexpected TLS packet was received\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A packet with illegal or unsupported version was received\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): A TLS record packet with invalid length was received\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Certificate is bad$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Decryption has failed\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Error decoding the received TLS packet\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): Error in the (pull|push) function\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): No common application protocol could be negotiated\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): No supported cipher suites have been found\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): The specified session has been invalidated for some reason\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? TLS error on connection from( [^[:space:]]+)?( \([^[:space:]]+\))? \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+ \((gnutls_handshake|recv|send)\): timed out$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]:( \[1[\\/][[:digit:]]+\])?( [[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]:]+ \[[[:digit:]]+\])? unexpected disconnection while reading SMTP command from ([^[:space:]]+|\([^[:space:]]+\)|[^[:space:]]+ \([^[:space:]]+\)) \[[[:xdigit:].:]+\]:[[:digit:]]+ I=\[[[:xdigit:].:]+\]:[[:digit:]]+( \(error: Connection reset by peer\))? D=([[:digit:]]+[ms])+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ exim\[[[:digit:]]+\]: \[([2-9]|[[:digit:]]{2,})[\\/][[:digit:]]+\] .*$
diff --git a/files/etc/logcheck/ignore.d.server/local-kernel b/files/etc/logcheck/ignore.d.server/local-kernel
index 35f520f..ab5a66a 100644
--- a/files/etc/logcheck/ignore.d.server/local-kernel
+++ b/files/etc/logcheck/ignore.d.server/local-kernel
@@ -1,8 +1,30 @@
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] USB Video Class driver \(1\.1\.1\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] lp: driver loaded but no devices found$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] i2c /dev entries driver$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Asymmetric key parser 'pkcs8' registered$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] loop: module loaded$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EXT4-fs \([[:alnum:]-]+\): mounted filesystem with ordered data mode\. Opts: acl$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] EXT4-fs \([[:alnum:]-]+\): re-mounted\. Opts: acl,errors=remount-ro$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: Core ver 2\.22$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: HCI device and connection manager initialized$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: HCI socket layer initialized$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: L2CAP socket layer initialized$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: SCO socket layer initialized$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM: chip id 63$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM: features 0x07$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM20702A$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: hci0: BCM20702A1 \(001\.002\.014\) build 0000$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP \(Ethernet Emulation\) ver 1\.3$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP filters: protocol multicast$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Bluetooth: BNEP socket layer initialized$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Initializing XFRM netlink socket
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 00:0[[:digit:]]: ttyS[[:digit:]] at I/O 0x[[:digit:]]f8 \(irq = [[:digit:]], base_baud = 115200\) is a 16550A$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 8021q: 802.1Q VLAN Support v1.8$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] 8021q: adding VLAN 0 to HW filter on device [[:alnum:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Added _OSI.*$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: (APIC|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|FPDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|RSDP|RSDT|SSDT|TPM2|UEFI|XSDT)( 0x[[:xdigit:]]+ [[:xdigit:]]+( \(v[[:digit:]]+ .*\))?)?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: TCPA 0x[[:xdigit:]]+ 000032 \(v02 COREv4 COREBOOT 00000000 CORE 20200110\)
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: bus type PCI registered$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: bus type USB registered$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Core revision [[:digit:]]+$
@@ -23,24 +45,25 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: LAPIC_NMI \(acpi_id\[0x[[:xdigit:]]+\] high edge lint\[0x1\]\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Local APIC address 0x[[:xdigit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Low-level resume complete$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Interrupt Link \[(INT|LNK)[[:alpha:]]\] \(IRQs [[:digit:][:space:]*]+)( [[:digit:]*]+)?(, disabled)?\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Interrupt Link \[(INT|LNK)[[:alpha:]]\] \(IRQs [[:digit:][:space:]*]+\)( [[:digit:]*]+)?(, disabled\.)?$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PCI Root Bridge \[PCI0\] \(domain 0000 \[bus 00-[[:xdigit:]]+\]\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpiphp: Slot \[[[:digit:]]+\] registered$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: PM-Timer IO Port: 0x[[:xdigit:]]+V?$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi PNP0A0[[:digit:]]:00: _OSC: OS supports \[ExtendedConfig ASPM ClockPM Segments MSI HPX-Type3\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] acpi PNP0A0[[:digit:]]:00: _OSC: OS now controls \[PCIeHotplug SHPCHotplug PME AER PCIeCapability LTR\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Button \[PWRB\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Button \[PWRF\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Resource \[(FN[[:digit:]]+|PG[[:digit:]]+|WRST)\] \((off|on)\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Power Resource \[(FN[[:digit:]]+|PG[[:digit:]]+|WRST|FPWR)\] \((off|on)\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \\_PR_\.CPU0: _OSC native thermal LVT Acked$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Preparing to enter system sleep state S3$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \\_PR_\.P[[:digit:]]+: Found 2 idle states$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Reserving (APIC|ASF!|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|SSDT|TPM2|UEFI) table memory at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Reserving (APIC|ASF!|DBG2|DBGP|DMAR|DSDT|FACP|FACS|FIDT|FPDT|HEST|HPET|IVRS|LPIT|MCFG|OEMB|SSDT|TCPA|TPM2|UEFI) table memory at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Sleep Button \[SLPB\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: \(supports( S[[:digit:]])+\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Thermal Zone \[TZ[[:digit:]]+\] \([[:digit:]]+ C\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Using IOAPIC for interrupt routing$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Video Device [GFX0] \(multi-head: yes  rom: no  post: no\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Video Device \[GFX0\] \(multi-head: yes  rom: no  post: no\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ACPI: Waking up from system sleep state S3$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Adding [[:digit:]]+k swap on [^.]+\.  Priority:-2 extents:1 across:[[:digit:]]+k (SS)?FS$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] AES CTR mode by8 optimization enabled$
@@ -102,6 +125,7 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] ACPI NVS$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] usable$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-e820: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] type 16$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] BIOS-provided physical RAM map:$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \.\.\. bit width:              48$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Block layer SCSI generic \(bsg\) driver version 0.4 loaded \(major [[:digit:]]+\)$
@@ -138,11 +162,11 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] device-mapper: ioctl: 4.43.0-ioctl \(2020-10-01\) initialised: dm-devel@redhat.com$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] device-mapper: uevent: version 1.0.3$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] devtmpfs: initialized$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\]  #[[:digit:]]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\]   [[:digit:]] base [[:xdigit:]]+ mask [[:xdigit:]]+ (uncachable|write-back|write-protect)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ( #[[:digit:]])+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\]   [[:digit:]] base [[:xdigit:]]+ mask [[:xdigit:]]+ (uncachable|write-back|write-protect|write-combining)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\]   [[:digit:]] disabled$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Disabling|Enabling) non-boot CPUs \.\.\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMA: preallocated 256 KiB GFP_KERNEL(\|GFP_DMA(32)?)? pool for atomic allocations$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMA: preallocated [[:digit:]]+ KiB GFP_KERNEL(\|GFP_DMA(32)?)? pool for atomic allocations$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: dmar[[:digit:]]: reg_base_addr [[:xdigit:]]+ ver 1:0 cap [[:xdigit:]]+ ecap [[:xdigit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: dmar[[:digit:]]: Using Queued invalidation$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: DRHD base: 0x[[:xdigit:]]+ flags: 0x[[:xdigit:]]$
@@ -154,9 +178,11 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR-IR: Queued invalidation will be enabled to support x2apic and Intr-remapping\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: No ATSR found$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMAR: RMRR base: 0x[[:xdigit:]]+ end: 0x[[:xdigit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: LENOVO 2325CT4/2325CT4, BIOS CBET4000 4.12-375-g7729b29a58 05/28/2020$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: MICRO-STAR INTERANTIONAL CO\.,LTD MS-7368/MS-7368, BIOS V1\.5B2 10/31/2007$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: PC Engines apu2/apu2, BIOS v4\.11\.0\.1 12/09/2019$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: System manufacturer System Product Name/P8H67-M PRO, BIOS 9005 09/18/2018$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] DMI: MSI MS-7816/H87-G43 \(MS-7816\), BIOS V2\.14B15 05/20/2019$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] done\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\] Connector [[:digit:]]:$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] \[drm\]     CRT1: INTERNAL_KLDSCP_DAC1$
@@ -334,8 +360,7 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: setup PV IPIs$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm-guest: stealtime: cpu [[:digit:]], msr [[:xdigit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] kvm: Nested Virtualization enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Last level dTLB entries: 4KB 512, 2MB 8, 4MB 4, 1GB 0$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Last level iTLB entries: 4KB [[:digit:]]+, 2MB [[:digit:]]+, 4MB [[:digit:]]+(, 1GB [[:digit:]]+)?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Last level (dTLB|iTLB) entries: 4KB [[:digit:]]+, 2MB [[:digit:]]+, 4MB [[:digit:]]+, 1GB [[:digit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] last_pfn = 0x[[:xdigit:]]+ max_arch_pfn = 0x[[:xdigit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] ledtrig-cpu: registered to indicate activity on CPUs$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Linux agpgart interface v0.103$
@@ -359,7 +384,7 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: Microcode Update Driver: v2.2\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] microcode: sig=0x[[:xdigit:]]+, pf=0x[[:xdigit:]]+, revision=0x[[:xdigit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mip6: Mobile IPv6$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Mount(point)?-cache hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] (Mountpoint-cache|Mount-cache) hash table entries: [[:digit:]]+ \(order: [[:digit:]], [[:digit:]]+ bytes, linear\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mousedev: PS/2 mouse device common for all mice$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Movable zone start for each node$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] mpls_gso: MPLS GSO support$
@@ -425,7 +450,8 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Intel PCH root port ACS workaround enabled$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: legacy IDE quirk: reg 0x[[:xdigit:]]+: \[io  0x[[:xdigit:]]+(-0x[[:xdigit:]]+)?\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Limiting direct PCI/PCI transfers$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PCI bridge to \[bus [[:digit:]-]+\] \(subtractive decode\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI host bridge to bus 0000:00$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PCI bridge to \[bus [[:digit:]-]+\]( \(subtractive decode\))?$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PIIX3: Enabling Passive Release$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: PME# supported from .*$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: reg 0x[[:xdigit:]]+: \[io  0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
@@ -440,19 +466,18 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: Video device with shadowed ROM at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:0[[:xdigit:]]:[[:xdigit:].]+: \[[[:xdigit:]]+:[[:xdigit:]]+\] type [[:digit:]]+ class 0x[[:xdigit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci 0000:[[:xdigit:]]{2}:[[:xdigit:]]{2}\.[[:xdigit:]]: PCI bridge to \[bus [[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]])? \[bus 00-[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]])? \[io  0x[[:xdigit:]]+-0x[[:xdigit:]]+( window)?\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]])? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]])? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+( window| 64bit| pref)*\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[bus 00-[[:xdigit:]]+\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[io  0x[[:xdigit:]]+-0x[[:xdigit:]]+( window)?\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:0[[:digit:]]:( root bus)? resource( [[:digit:]]+)? \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+( window| 64bit| pref)*\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pci_bus 0000:[[:xdigit:]]+: Allocating resources$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: CLS [[:digit:]]+ bytes, default 64$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI-DMA: Using software bounce buffering for IO \(SWIOTLB\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: (AER|PME): enabled with IRQ [[:digit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:]]+\.[[:digit:]]: Enabling MPC IRBNCE$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:]]+\.[[:digit:]]: Intel PCH root port ACS workaround enabled$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise\+ Interlock- NoCompl\+ IbPresDis- LLActRep\+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: pciehp: Slot #0 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug\+ Surprise\+ Interlock- NoCompl\+ IbPresDis- LLActRep\+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] pcieport 0000:00:[[:xdigit:].]+: PME: Signaling with IRQ [[:digit:]]+$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI host bridge to bus 0000:00$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI Interrupt Link \[LNK[CD]\] enabled at IRQ [[:digit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved in ACPI motherboard resources$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PCI: MMCONFIG at \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\] reserved in E820$
@@ -501,8 +526,8 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] process '/usr/bin/fstype' started with executable stack$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PTP clock support registered$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] PV qspinlock hash table entries: 256 \(order: 0, 4096 bytes, linear\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: jumbo features \[frames: 4074 bytes, tx checksumming: ko\]$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: RTL8168b/8111b, [[:xdigit:]:]+, XID [[:digit:]]+, IRQ [[:digit:]]+$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: jumbo features \[frames: [[:digit:]]+ bytes, tx checksumming: ko\]$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 0000:0[[:digit:]]:00\.0 [[:alnum:]]+: RTL8168[[:alpha:]]+/8111[[:alpha:]]+, [[:xdigit:]:]+, XID [[:xdigit:]]+, IRQ [[:digit:]]+$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 [[:digit:]:.]+ [[:alnum:]]+: Link is Down$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] r8169 [[:digit:]:.]+ [[:alnum:]]+: Link is Up - 1Gbps/Full - flow control (off|rx/tx)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] radeon 0000:0[[:digit:]]:0[[:digit:]]\.0: fence driver on ring 0 use gpu addr 0x[[:xdigit:]]+$
@@ -516,11 +541,12 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: sse2x[[:digit:]]   gen\(\) [[:digit:][:space:]]+ MB/s$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: sse2x[[:digit:]]   xor\(\) [[:digit:][:space:]]+ MB/s$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm avx2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm avx2x4 gen\(\) [[:digit:][:space:]]+ MB/s$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm sse2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using algorithm sse2x2 gen\(\) [[:digit:][:space:]]+ MB/s$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using avx2x2 recovery algorithm$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: using ssse3x2 recovery algorithm$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: \.\.\.\. xor() [[:digit:]]+ MB/s, rmw enabled$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] raid6: \.\.\.\. xor\(\) [[:digit:]]+ MB/s, rmw enabled$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAMDISK: \[mem 0x[[:xdigit:]]+-0x[[:xdigit:]]+\]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: chronyc: uninitialized urandom read \(4096 bytes read\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: crng init done$
@@ -528,11 +554,11 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: ln: uninitialized urandom read \(6 bytes read\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: lvm: uninitialized urandom read \([[:digit:]]+ bytes read\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] random: mktemp: uninitialized urandom read \(8 bytes read\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: API unit is 2^-32 Joules, [[:digit:]] fixed counters, [[:digit:]]+ ms ovfl timer$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain dram 2^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain package 2^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp0-core 2^-14 Joules$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp1-gpu 2^-14 Joules$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: API unit is 2\^-32 Joules, [[:digit:]] fixed counters, [[:digit:]]+ ms ovfl timer$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain dram 2\^-14 Joules$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain package 2\^-14 Joules$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp0-core 2\^-14 Joules$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RAPL PMU: hw unit of domain pp1-gpu 2\^-14 Joules$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=[[:digit:]]$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Hierarchical RCU implementation\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rcu: Hierarchical SRCU implementation\.$
@@ -547,14 +573,11 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered tcp NFSv4\.1 backchannel transport module\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered tcp transport module\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RPC: Registered udp transport module\.$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one day, 114 bytes nvram, hpet irqs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one day, y3k, 114 bytes nvram, hpet irqs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one month, y3k, 114 bytes nvram, hpet irqs$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one month, y3k, 242 bytes nvram, hpet irqs$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: alarms up to one (day|month),( y3k,)? [[:digit:]]+ bytes nvram, hpet irqs$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: registered as rtc0$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: RTC can wake from S4$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] rtc_cmos 00:0[[:digit:]]: setting system clock to [[:digit:]T:-]+ UTC \([[:digit:]]+\)$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RTL8211B Gigabit Ethernet r8169-0-200:00: attached PHY driver \[RTL8211B Gigabit Ethernet\] \(mii_bus:phy_addr=r8169-0-200:00, irq=IGNORE\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] RTL8211[[:alpha:]] Gigabit Ethernet r8169-0-200:00: attached PHY driver \[RTL8211[[:alpha:]] Gigabit Ethernet\] \(mii_bus:phy_addr=r8169-0-200:00, irq=IGNORE\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Run /init as init process$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] Scanning NUMA topology in Northbridge 24$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sched_clock: Marking stable \([[:digit:]]+, [[:digit:]]+\)->\([[:digit:]]+, -[[:digit:]]+\)$
@@ -563,7 +586,7 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] scsi host[[:digit:]]: pata_atiixp$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] 4096-byte physical blocks$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Attached SCSI disk$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] [[:digit:]]+ 512-byte logical blocks: \([[:digit:]]+ GB/[[:digit:]]+ GiB\)$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] [[:digit:]]+ 512-byte logical blocks: \([[:digit:].]+ [TG]B/[[:digit:].]+ [TG]iB\)$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] (Stopping|Starting) disk$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Synchronizing SCSI cache$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ kernel: \[ *[[:digit:]]+\.[[:digit:]]+\] sd [[:digit:]:]+: \[[[:alnum:]]+\] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA$
diff --git a/files/etc/logcheck/ignore.d.server/local-smart b/files/etc/logcheck/ignore.d.server/local-smart
index c510696..19ea1dd 100644
--- a/files/etc/logcheck/ignore.d.server/local-smart
+++ b/files/etc/logcheck/ignore.d.server/local-smart
@@ -1,7 +1,7 @@
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Configuration file /etc/smartd.conf was parsed, found DEVICESCAN, scanning devices$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Copyright (C) [[:digit:]-]+, .*, www\.smartmontools\.org$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Copyright \(C\) [[:digit:]-]+, .*, www\.smartmontools\.org$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], found in smartd database: .*$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], [^,]+, S/N:[[:alpha:]]+,( WWN:[[:alnum:]-]+,)? FW:[[:alpha:].]+, [[:digit:]]+ GB$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+ \[SAT\], [^,]+, S/N:[[:alnum:]]+,( WWN:[[:alnum:]-]+,)? FW:[[:alnum:].]+, [[:digit:].]+ [GT]B$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Device: /dev/[[:alnum:]]+, type changed from 'scsi' to 'sat'$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Drive: DEVICESCAN, implied '-a' Directive on line 21 of file /etc/smartd.conf$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ smartd\[[[:digit:]]+\]: Monitoring [[:digit:]]+ ATA/SATA, [[:digit:]]+ SCSI/SAS and [[:digit:]]+ NVMe devices$
diff --git a/files/etc/logcheck/ignore.d.server/local-tor b/files/etc/logcheck/ignore.d.server/local-tor
index b8c24e9..99471de 100644
--- a/files/etc/logcheck/ignore.d.server/local-tor
+++ b/files/etc/logcheck/ignore.d.server/local-tor
@@ -1,7 +1,13 @@
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Heartbeat: Tor's uptime is ([[:digit:]]+ day(s)? )?[[:digit:]]+:[[:digit:]]+ hours, with [[:digit:]]+ circuits open. I've sent [[:digit:].]+ [GMk]B and received [[:digit:].]+ [GMk]B\.( I've received [[:digit:]]+ connections on IPv4 and [[:digit:]]+ on IPv6. I've made [[:digit:]]+ connections with IPv4 and [[:digit:]]+ with IPv6\.)?$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Average packaged cell fullness: [[:digit:].]+%\. TLS write overhead: [[:digit:]]+%$
-^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Received http status code 404 \("Consensus is too old"\) from server '[[:xdigit:]:.]+:443' while fetching consensus directory\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Bootstrapped 0% \(starting\): Starting$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Heartbeat: Tor's uptime is ([[:digit:]]+ day(s)? )?[[:digit:]]+:[[:digit:]]+ hours, with [[:digit:]]+ circuits open. I've sent [[:digit:].]+ [GMk]B and received [[:digit:].]+ [GMk]B\.( I've received [[:digit:]]+ connections on IPv4 and [[:digit:]]+ on IPv6. I've made [[:digit:]]+ connections with IPv4 and [[:digit:]]+ with IPv6\.)?$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: http status 400 \("Nonauthoritative directory does not accept posted server descriptors"\) response from dirserver '[[:xdigit:]:.]+:[[:digit:]]+'\. Malformed rendezvous descriptor\?$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Interrupt: exiting cleanly\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Our onion service received [[:digit:]]+ v2 and [[:digit:]]+ v3 INTRODUCE2 cells and attempted to launch [[:digit:]]+ rendezvous circuits\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Parsing GEOIP IPv4 file /usr/share/tor/geoip\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Parsing GEOIP IPv6 file /usr/share/tor/geoip6\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Received http status code 404 \("Consensus is too old"\) from server '[[:xdigit:]:.]+:443' while fetching consensus directory\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Starting with guard context "default"$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: Tor has been idle for [[:digit:]]+ seconds; assuming established circuits no longer work\.$
+^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: We compiled with OpenSSL 101010ef: OpenSSL 1\.1\.1n  15 Mar 2022 and we are running with OpenSSL 101010ef: 1.1.1n\. These two versions should be binary compatible\.$
 ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ Tor\[[[:digit:]]+\]: While (not )?bootstrapping, fetched this many bytes: [[:digit:]]+ \((consensus network-status fetch|authority cert fetch|microdescriptor fetch)\)(; [[:digit:]]+ \((consensus network-status fetch|authority cert fetch|microdescriptor fetch)\))*$
diff --git a/files/etc/logcheck/ignore.d.workstation/local-bluetooth b/files/etc/logcheck/ignore.d.workstation/local-bluetooth
index 8cf3fd1..51d7f5c 100644
--- a/files/etc/logcheck/ignore.d.workstation/local-bluetooth
+++ b/files/etc/logcheck/ignore.d.workstation/local-bluetooth
@@ -1,5 +1,15 @@
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: /org/bluez/hci[[:digit:]]+/dev_[[:xdigit:]_]+(/sep[[:digit:]]+)?/fd[[:digit:]]+: fd\([[:digit:]]+\) ready$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get io data for Headset Voice gateway: getpeername: Transport endpoint is not connected \([[:digit:]]+\)$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Host is down$
-^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Connection refused$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Bluetooth daemon 5\.55$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Bluetooth management interface 1\.18 initialized$
 ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: connect error: Host is down \([[:digit:]]+\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSink/sbc$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSink/sbc$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSource/sbc$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Endpoint unregistered: sender=:1.192 path=/MediaEndpoint/A2DPSource/sbc$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Exit$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: /org/bluez/hci[[:digit:]]+/dev_[[:xdigit:]_]+(/sep[[:digit:]]+)?/fd[[:digit:]]+: fd\([[:digit:]]+\) ready$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Starting SDP server$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Stopping SDP server$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Terminating$
+#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Connection refused$
+#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get Headset Voice gateway SDP record: Host is down$
+#^\w{3} [ :0-9]{11} [._[:alnum:]-]+ bluetoothd\[[0-9]+\]: Unable to get io data for Headset Voice gateway: getpeername: Transport endpoint is not connected \([[:digit:]]+\)$