[exim] Logging to SysLog just some events

Hi, list!

I'm trying to write an automatically procedure to add an IP to a blacklist if
it tries to authenticate itself (failing!) too much.

Unfortunately, I can't do it from Exim, because there is no ACL called after an
authentication failure.

Now I had the idea to log the authentication failures to SysLog and then to
bind a program on the SysLog to manage these entries.

Is it possible to log JUST the authentication failures to the SysLog (too!) and
not the other entries?
How?

P.S.: of course, if you have a better idea to solve my problem, please tell me!
:)

Thanks a lot
Luca Bertoncello
(lucabert@???)