Hi, here are some corrections/additions for the newly added postfix-mysql rules (from my own ruleset, hopefully to be retired someday):
^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: sql plugin doing query select password from [_[:alnum:]]+ where [_[:alnum:]]+='[EMAIL PROTECTED]:alnum:]-]+';?$ * do not hardcode table and column names ('password' does not seem a variable column name but a fixed string) * the trailing semicolon is optional (I've seen this message with and without ...) ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtpd\[[0-9]+\]: sql plugin create statement from (userPassword|cmusaslsecret(PLAIN|CRAM-MD5|DIGEST-MD5)) [._[:alnum:]-]+ [.[:alnum:]-]+$ * the plugin creates more statements ... * the trailing $ was missing Andreas -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]