This message is from postfix ( http://sourcecodebrowser.com/postfix/2.9.1/smtpd__sasl__glue_8c_source.html#l00315 )

as for sasl implementations like dovecot there's (#384) and probably a few expressions in cyrus-sasl (http://sourcecodebrowser.com/cyrus-sasl2/2.1.19.dfsg1/lib_2common_8c.html#a8db542541d230a84f61b5775010eae09) that I haven't tracked down. We'd end up logging them twice if we added those regexs to this filter.