how to source smtp authentication failure

[keat63]

I have a user who is being firewalled out from home due to smtp authentication failure.
However, being a manager, she has access to about 10 different business mailboxes.
I've looked through various logs and can see her IP being denied, but i'm unable to find which account is causing this.
Any ideas which log i need to look through to find which account is causing the smtp auth failure ?

 

[cPanelMichael]

Hello,

You can review /var/log/maillog to see if there are any POP3 or IMAP authentication failures from the IP address. Or, you could review /var/log/exim_mainlog for SMTP failures. EX:

exigrep "Customer-IP-Address" /var/log/exim_mainlog

Thank you.