[root@onehost ~]# rpm -qa | grep dovecot
dovecot-2.2.27-10.el7.centos.x86_64
dovecot-mysql56-2.2.27-10.el7.centos.x86_64
[root@onehost ~]# systemctl status dovecot
● dovecot.service - Dovecot IMAP/POP3 email server
   Loaded: loaded (/usr/lib/systemd/system/dovecot.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2020-01-09 23:21:32 UTC; 12h ago
     Docs: man:dovecot(1)
           http://wiki2.dovecot.org/
 Main PID: 4162 (dovecot)
    Tasks: 11
   Memory: 6.4M
   CGroup: /system.slice/dovecot.service
           ├─ 4162 /usr/sbin/dovecot
           ├─ 4174 dovecot/anvil
           ├─ 4175 dovecot/log
           ├─ 4182 dovecot/config
           ├─ 4185 dovecot/auth
           ├─ 9815 dovecot/pop3-login
           ├─ 9818 dovecot/pop3-login
           ├─ 9819 dovecot/pop3-login
           ├─18447 dovecot/imap-login
           ├─18636 dovecot/imap-login
           └─30924 dovecot/imap-login

Jan 10 06:19:17 onehost.pp.ua dovecot[4175]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.203.197.23, lip=209.250.241.201, session=<NlAHG8ObYpGfy8UX>
Jan 10 07:18:54 onehost.pp.ua dovecot[4175]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=159.203.201.39, lip=209.250.241.201, TLS, session=<xjQz8MObHpqfy8kn>
Jan 10 08:54:51 onehost.pp.ua dovecot[4175]: imap-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=138.99.216.171, lip=209.250.241.201, TLS handshaking: Disconnected, session=<6sJZR8WbSO6KY9ir>
Jan 10 10:35:15 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=89.248.169.12, lip=209.250.241.201, session=<dDRrrsabOIlZ+KkM>
Jan 10 10:39:03 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=89.248.169.12, lip=209.250.241.201, session=<owEGvMabuplZ+KkM>
Jan 10 10:44:38 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: Disconnected, session=<lwH4z8abTKqsaVpP>
Jan 10 10:44:40 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: Disconnected, session=<vkAP0MabIK2saVpP>
Jan 10 10:44:40 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_...<V4kP0Mab6K+saVpP>
Jan 10 10:44:40 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: SSL_accept() failed: error:1408A10B:SSL routines:ssl3_get_c...<HP8P0Mab9K+saVpP>
Jan 10 10:44:41 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS: Disconnected, session=<wxgo0MabALCsaVpP>
Hint: Some lines were ellipsized, use -l to show in full.
[root@onehost ~]# systemctl status dovecot
● dovecot.service - Dovecot IMAP/POP3 email server
   Loaded: loaded (/usr/lib/systemd/system/dovecot.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2020-01-09 23:21:32 UTC; 12h ago
     Docs: man:dovecot(1)
           http://wiki2.dovecot.org/
 Main PID: 4162 (dovecot)
    Tasks: 11
   Memory: 6.4M
   CGroup: /system.slice/dovecot.service
           ├─ 4162 /usr/sbin/dovecot
           ├─ 4174 dovecot/anvil
           ├─ 4175 dovecot/log
           ├─ 4182 dovecot/config
           ├─ 4185 dovecot/auth
           ├─ 9815 dovecot/pop3-login
           ├─ 9818 dovecot/pop3-login
           ├─ 9819 dovecot/pop3-login
           ├─18447 dovecot/imap-login
           ├─18636 dovecot/imap-login
           └─30924 dovecot/imap-login

Jan 10 06:19:17 onehost.pp.ua dovecot[4175]: imap-login: Disconnected: Too many invalid commands (no auth attempts in 0 secs): user=<>, rip=159.203.197.23, lip=209.250.241.201, session=<NlAHG8ObYpGfy8UX>
Jan 10 07:18:54 onehost.pp.ua dovecot[4175]: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=159.203.201.39, lip=209.250.241.201, TLS, session=<xjQz8MObHpqfy8kn>
Jan 10 08:54:51 onehost.pp.ua dovecot[4175]: imap-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=138.99.216.171, lip=209.250.241.201, TLS handshaking: Disconnected, session=<6sJZR8WbSO6KY9ir>
Jan 10 10:35:15 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=89.248.169.12, lip=209.250.241.201, session=<dDRrrsabOIlZ+KkM>
Jan 10 10:39:03 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=89.248.169.12, lip=209.250.241.201, session=<owEGvMabuplZ+KkM>
Jan 10 10:44:38 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: Disconnected, session=<lwH4z8abTKqsaVpP>
Jan 10 10:44:40 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 2 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: Disconnected, session=<vkAP0MabIK2saVpP>
Jan 10 10:44:40 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: SSL_accept() failed: error:1407609C:SSL routines:SSL23_GET_...<V4kP0Mab6K+saVpP>
Jan 10 10:44:40 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS handshaking: SSL_accept() failed: error:1408A10B:SSL routines:ssl3_get_c...<HP8P0Mab9K+saVpP>
Jan 10 10:44:41 onehost.pp.ua dovecot[4175]: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=172.105.90.79, lip=209.250.241.201, TLS: Disconnected, session=<wxgo0MabALCsaVpP>
Hint: Some lines were ellipsized, use -l to show in full.
[root@onehost ~]# netstat -plunt | grep dovecot
grep: invalid option -- 'p'
Usage: grep [OPTION]... PATTERN [FILE]...
Try 'grep --help' for more information.