Scott, your regexes are exact, of course ! In addition, searching for the last occurrence makes sense, as we want to know the final state of all these servers.
However, I must miss something ! To my mind, we should search for the last line, with the word connected, for each server, ONLY IF a previous line, with the word disconnected, for the according server, has not been found !
For instance, if we consider the part of the Zeff's log, below :05/23/2017 05:04:09 AM SMTP Server: qwerty321f.domain.com (xxx.xxx.xxx.xxx) connected 05/23/2017 05:04:10 AM Router: Transferred 1 messages to SERVER004/DOMAIN via Notes 05/23/2017 05:04:10 AM SMTP Server: Message 0031D206 (…) received 05/23/2017 05:04:10 AM SMTP Server: qwerty321f.domain.com (xxx.xxx.xxx.xxx) disconnected. 1 message[s] received
To my mind, it looks like, on 05/23/2017 05:04:10 AM, the server "qwerty321f" is disconnected. No ? Of course, I suppose that the string xxx.xxx.xxx.xxx, in the first and last line, just above, represents the same IPV4 address !