From 7aa94cc500af60c15c303be9ea2d193db3e5a4c8 Mon Sep 17 00:00:00 2001
From: Zubrikhin Alexey <zubrihin@v-lazer.com>
Date: Fri, 24 Nov 2023 12:37:21 +1000
Subject: [PATCH] * dovecot decoder fix

---
 etc/decoder.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/decoder.xml b/etc/decoder.xml
index dd837c05b..25f3b00ed 100644
--- a/etc/decoder.xml
+++ b/etc/decoder.xml
@@ -971,7 +971,7 @@ Jan  8 19:32:41 tp.lan dropbear[15165]: Pubkey auth succeeded for 'root' with ke
 <decoder name="dovecot-disconnect">
   <parent>dovecot</parent>
   <prematch_pcre2 offset="after_parent">^\w{4}-login: Disconnected: </prematch_pcre2>
-  <pcre2 offset="after_prematch">^rip=(\S+), lip=(\S+)</pcre2>
+  <pcre2 offset="after_prematch">^rip=(\S+), lip=(\S+)(?:,|$)</pcre2>
   <order>srcip, dstip</order>
 </decoder>