Hi, the correct line for /etc/logcheck/ignore.d.server/courier-imap is: --- ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ imapd: LOGIN, user=[-_.@[:alnum:]]+, ip=\[[.:[:alnum:]]+\], port=\[[0-9]{5}\], protocol=IMAP$ --- Would be nice if this could be included in future releases. smo