Hi,
my postfix log contains quite a large number of these lines:
Apr 08 20:13:45 mail postfix/smtpd[2127]: warning: unknown[141.98.11.14]: SASL PLAIN authentication failed:
Unfortunately, they are not picked up by the relevant regex, because the regex expects a space after "failed:" (typically, a more detailed SASL error explanation follows).
Would it make sense to remove the trailing space from the regex? I can open a PR, if this sounds like a reasonable idea.