Dovecot en el análisis de entrada sospechosa auth.log

Me pregunto si esta entrada en auth.log es algo que debería preocuparme

Feb 22 12:18:25 host1 auth: pam_unix(dovecot:auth): check pass; user unknown
Feb 22 12:18:25 host1 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=swann rhost=50.227.181.106 
Feb 22 12:19:37 host1 saslauthd[2055]: pam_unix(smtp:auth): check pass; user unknown
Feb 22 12:19:37 host1 saslauthd[2055]: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= 
Feb 22 12:19:38 host1 saslauthd[2055]: DEBUG: auth_pam: pam_authenticate failed: Authentication failure