couldn't malicious attempt have an empty user name which would log as just nothing, thus not matching ```.+```?

my whining is primarily about trying to anchor the end correctly... what if we list all of the possible endings (looking at ```grep -r 'Login failed' proftpd-dfsg-1.3.5\~rc3```

```
__suffix_failed_login = (User not authorized|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit (access|configuration) denies login|Not a UserAlias).?
```

and then end that one with it

```
^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\):  %(__suffix_failed_login)s\s*$ 
```

it would imply getting more samples of failed log lines