bfd rules for exim

[m4ri00sh]

I need some rule for bfd so it could scan/check exim mainlog for "Incorrect authentication data" ....
Lots of stuff in log like:

2007-06-04 07:27:26 login authenticator failed for (mr) [219.137.189.133]: 535 Incorrect authentication data (set_id=webmaster)

unless there is other way of blocking them... please advise