Fail2ban fails to detect failed dovecot login attempts immediately
I just upgraded my debian 9 to 10, ispconfig is not yet updated, so I don't know if you already have a fix for this bug:
Dovecot logs only once all the failed login attempts per session to mail.log on disconnect with just a line like this:
imap-login: Disconnected: Too many invalid commands (auth failed, 20 attempts in 39 secs)
So fail2ban is unable to detect the failed login attempt immediately.
I don't know if there is a better way to fix it, but I had to add auth_verbose = yes to dovecot.conf to fix it.