logwatch does not manage the new functionnality available in dovecot 3.x which is submission protocol.
You can have this kind of logs :
2025-08-07T09:45:15.909392+02:00 server9 dovecot: submission-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=172.94.96.184, lip=yyy.210.65.xx, session=<mrdfo8e7bc+sxmc4>
2025-08-07T09:45:50.408115+02:00 server9 dovecot: submission-login: Disconnected: Connection closed (unfinished AUTH command) (auth failed, 4 attempts in 34 secs): user=abc-3@server9.fff.org, method=LOGIN, rip=172.94.96.184, lip=yyy.210.65.xx, session=<cjdgo8e7xn+sxmc4></cjdgo8e7xn+sxmc4></mrdfo8e7bc+sxmc4>
This kind of lines should be ignored also :
2025-08-24T10:58:31.691213+02:00 server9 dovecot: submission(fs@test.org)<2189752><az+mpbg9iqzbofqc>: Successfully relayed message: from=fc@test.org, size=730, id=E98nCDfUqmi4aSEAkhEa2Q, nrcpt=1, reply=`250 2.0.0 ok 1756025911 qp 2189755'</az+mpbg9iqzbofqc>
I implemented this for myself. Attached patch is against 7.13
Thanks for the patch; let us know if that fixes the issue.