[Definition] # Matches the UID from the mail logs # Action then translates to the User failregex = postfix/pickup\[(.*?)]: .* uid=<HOST> # postfix/sendmail\[(.*?)]: fatal: User .*\(<HOST>\) is not allowed to submit mail ignoreregex =