This is the pattern after trial and error, that I found worked with the www.qmailtoaster.com setup.
$pat = '^[LOGTIME] \S+ vpopmail\[\d+\]: vchkpw-pop3: \(PLAIN\) ' .
'login success \S+:(\d+\.\d+\.\d+\.\d+)';.
2007-08-07 17:42:25 UTC in pop-before-smtp
