+ev_auth:
+ accept condition = ${if eq {$event_name}{auth:fail}}
+ logwrite = . \
+ "auth fail" \
+ event_data <$event_data> \
+ sender_host_authenticated <$sender_host_authenticated> \
+ authenticated_fail_id <$authenticated_fail_id>
+
+ accept logwrite = UNEXPECTED $event_name
+