Scalix Forums

You could try audit logging for the IMAP process - omconfaud -a imap # - but this doesn't appear to give you any indication if a user has failed to logon .

Then there is the swa.properties file that has logging options at the bottom for you to try, you can set this logging up for individual users for testing.

IMAP audit on level 11 was logging this for a login attempt with a wrong password:

655 means authentication failed.
The reported IP belongs to the server itself.
If you need to know the IP address of the client you will have to check the Apache logs for the time in question.