Yer i got it working by using syslog for all failed passwords, rather than auth.log
Code:
[Definition]
failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*
gnoreregex =
works a treat.
On Debian (etch) you will have to do this, for it to work (or at least i seemed to have to)
Code:
echo "yes" > /etc/pure-ftpd/conf/DontResolve
/etc/init.d/pure-ftpd-mysql restart