Linux command to find user who failed to login from pop/imap

 journalctl -u dovecot -g "auth failed" grep -i "auth failed" /var/log/mail.log | grep -E "imap|pop" journalct...