> looks good to me (and you beat me to remove 2.5 from travis setup ;) )

np

> -- but may be worth adding a test-case where PID would differ thus should not result in the match?

Yep. I did this with sendmail-spam. Waiting for feedback on the mail list to ensure that the pids do match.

> also how likely it would be for the same PID to get reused on a busy server thus leading to false positives

Within the same maxlines in the log output? virtually none.

> or there is no other case where "Connection closed by" would appear for some legit connections (please remind me)?

Not with an authentication fail match in the came connection.