Linux command to find user who failed to login from pop/imap

 journalctl -u dovecot -g "auth failed"

grep -i "auth failed" /var/log/mail.log | grep -E "imap|pop"

journalctl -u dovecot -g "auth failed" | grep -oE "user=<.*?>" | sort | uniq -c

grep "auth failed" /var/log/maillog | awk '{print $NF}' | sort | uniq -c | sort -nr

grep "auth failed" /var/log/maillog | grep "@example.com" | head

grep "auth failed" /var/log/maillog | \

grep -oE '[A-Za-z0-9._%+-]+@example\.com' | \

sort | uniq -c | sort -nr

grep "auth failed" /var/log/maillog | \

awk '/@example\.com/ {print $NF}' | \

sort | uniq -c | sort -nr

Dovecot: Disconnected, connection closed, auth failed

 From webmin dashboard>Servers>Postfix Mail Server> Virtual Domains> Find specific user maping 

Install imap extension on PHP 7.x or Higher in CentOS 8

yum update -y 

yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm 

yum install -y https://rpms.remirepo.net/enterprise/remi-release-7.rpm 

yum install -y php80-php-imap 

cp /opt/remi/php80/root/usr/lib64/php/modules/imap.so /usr/lib64/php/modules/ /bin/echo 'extension="imap.so"' > /etc/php.d/40-imap.ini 

systemctl restart php-fpm