[Definition]
failregex = ^{.*Login failed: '.*' \(Remote IP: '<HOST>'.*}$
^{.*Login failed: .* \(Remote IP: <HOST>.*}$
Works for me on NC16 and should also do for NC17.
[Definition]
failregex = ^{.*Login failed: '.*' \(Remote IP: '<HOST>'.*}$
^{.*Login failed: .* \(Remote IP: <HOST>.*}$
Works for me on NC16 and should also do for NC17.