Linux command to find user who failed to login from pop/imap

 journalctl -u dovecot -g "auth failed"

grep -i "auth failed" /var/log/mail.log | grep -E "imap|pop"

journalctl -u dovecot -g "auth failed" | grep -oE "user=<.*?>" | sort | uniq -c

grep "auth failed" /var/log/maillog | awk '{print $NF}' | sort | uniq -c | sort -nr

grep "auth failed" /var/log/maillog | grep "@example.com" | head

grep "auth failed" /var/log/maillog | \

grep -oE '[A-Za-z0-9._%+-]+@example\.com' | \

sort | uniq -c | sort -nr

grep "auth failed" /var/log/maillog | \

awk '/@example\.com/ {print $NF}' | \

sort | uniq -c | sort -nr