It would be great to know what service (program) was
used. For example to have it automaticaly from pam
context (i.e. config file: /etc/pam.d/imap == service
imap) or custom as a field ( logservicecolumn=service
logservice=imap ).
With that it would be possible to categorize log
entries.
Thanks.