Yer i got it working by using syslog for all failed passwords, rather than auth.log [Definition] failregex = .*pure-ftpd: \(.*@<HOST>\)...
Separate names with a comma.
