Please consider adjusting the proftpd regex to account for the proftpd.conf option:
UseReverseDNS on
which will use domain names in the log, i.e.:
Jun 21 19:40:47 slate proftpd[4586]: slate.XXX.net (XYZ.XXX.net[1.2.3.4]) - USER dsfsdfsd: no such user found from XYZ.XXX.net [1.2.3.4] to 5.6.7.8:21
Thanks.
Rob