prefix=%date:date-rfc3164% %host:word% %tag:char-to:\x3a%:
rule=: restart.
rule=: Bad line received from identity server at %ip:ipv4%: %port:number% 
rule=: FTP session closed
rule=: wu-ftpd - TLS settings: control %wuftp-control:char-to:,%, client_cert %wuftp-clcert:char-to:,%, data %wuftp-allow:word%
rule=: User %user:word% timed out after %timeout:number% seconds at %otherdatesyntax:word% %otherdate:date-rfc3164% %otheryear:word%
rule=: getpeername (in.ftpd): Transport endpoint is not connected
# the one below is problematic (and needs some backtracking)
#: %disk:char-to:\x3a%: timeout waiting for DMA