Anyway to ban only login failed?
Dec 13 11:56:14 postfix/smtpd[1330]: connect from unknown[141.98.10.220]
Dec 13 11:56:14 plesk_saslauthd[1332]: listen=6, status=5, dbpath='/var/spool/postfix/plesk/passwd.db', keypath='/var/spool/postfix/plesk/passwd_db_key', chroot=0, unprivileged=1
Dec 13...