more precise anchored RE (also combining all 3 REs in a single regex)

config/filter.d/monitorix.conf

@@ -16,9 +16,7 @@ _daemon = monitorix-httpd
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values:  TEXT
 #
-failregex = NOTEXIST - \[<HOST>\] .*
-            AUTHERR - \[<HOST>\] .*
-            NOTALLOWED - \[<HOST>\] .*
+failregex = ^(?:\s+-)?\s*(?:NOTEXIST|AUTHERR|NOTALLOWED) - <ADDR>\b
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.