All the lines in /etc/fail2ban/filter.d/exim.conf start with "^%(pid)s "

Those characters are trying to match a PID at the start of log lines, I guess.

Actually in /etc/fail2ban/filter.d/exim-common.conf I see:

pid = ( \[\d+\])?

But the problem is that the lines in /var/log/exim4/mainlog contain no PIDs at
the start of the line.

from http://www.exim.org/exim-html-current/doc/html/spec_html/ch-log_files.html:

"Exim does not include its process id in log lines by default, but you can
request that it does so by specifying the pid log selector (see section 52.15).
When this is set, the process id is output, in square brackets, immediately
after the time and date. "

So that is an optional feature of exim, but it is not enabled by default.

So certainly the regexes in /etc/fail2ban/filter.d/exim.conf are broken and need
to be fixed.

Thanks,
Alex