diff --git a/debian/logcheck/evolix_courier b/debian/logcheck/evolix_courier
new file mode 100644
index 0000000..aaa1ae0
--- /dev/null
+++ b/debian/logcheck/evolix_courier
@@ -0,0 +1 @@
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ authdaemond: pam_unix\(imap:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
diff --git a/debian/logcheck/evolix_saslauthd b/debian/logcheck/evolix_saslauthd
new file mode 100644
index 0000000..a19c8b4
--- /dev/null
+++ b/debian/logcheck/evolix_saslauthd
@@ -0,0 +1,4 @@
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ saslauthd\[[0-9]+\]: Authentication failed for [.-\/[:alnum:]-]+: Bind to ldap server failed \(invalid user/password or insufficient access\) \(-7\)$
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ saslauthd\[[0-9]+\]: do_auth         : auth failure: \[user=[.[:alnum:]-]+\] \[service=smtp\] \[realm=[.[:alnum:]-]*\] \[mech=(ldap|pam)\] \[reason=(Unknown|PAM auth error)\]$'
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ saslauthd\[[0-9]+\]: pam_unix\(smtp:auth\): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=
+^\w{3} [ :0-9]{11} [._[:alnum:]-]+ saslauthd\[[0-9]+\]: DEBUG: auth_pam: pam_authenticate failed: User not known to the underlying authentication module$