dovecotplain (lfd) regex

gistfile1.txt

[~]# /usr/local/cpanel/3rdparty/bin/perl -ne '/^\S+\s+\S+\s+(\[\d+\] )?(\S+) authenticator failed for \S+ (.*)?\[(\S+)\](:\S*:?)? 535 Incorrect authentication data (\(set_id=(\S+)\))?/ && print' /var/log/exim_rejectlog |tail -3
2015-09-07 01:25:04 [47185] dovecot_plain authenticator failed for () [IP_ADDRESS]:50674: 535 Incorrect authentication data (set_id=EMAIL_ADDRESS)
2015-09-07 01:25:11 [47185] dovecot_plain authenticator failed for () [IP_ADDRESS]:50674: 535 Incorrect authentication data (set_id=EMAIL_ADDRESS)
2015-09-07 01:25:15 [47185] dovecot_plain authenticator failed for () [IP_ADDRESS]:50674: 535 Incorrect authentication data (set_id=EMAIL_ADDRESS)

CUSTOM2_LOG = "/var/log/exim_rejectlog"

if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ /^\S+\s+\S+\s+(\[\d+\] )?(\S+) authenticator failed for \S+ (.*)?\[(\S+)\](:\S*:?)? 535 Incorrect authentication data (\(set_id=(\S+)\))?/)) {
      `echo "IS MATCHED" > /tmp/test`;
      return ("Failed SMTP authentication",$1,"dovecotplain","5","25","1");
}

-rw------- 1 root root 11 Sep  7 01:25 /tmp/test

# cat /tmp/test 
IS MATCHED