I just ran this with the new sample test case, and noted that this regex and:
`^%(_apache_error_client)s (Digest: )?user .*: password mismatch: \S*\s*$`
are overlapping on line 34 in the sample log.