Dovecot top stats

Hi,

I have being try to track down top email users to sometime. When I do a network traffic check I can see there is about 15 times more email traffic pulled from mail server than sent.

The problem I am trying to track down is which users are the culprit.

I have enabled doevcot stats and I can do a doveadm stats dump user but I get a 0 for disk_input, disk_output, read_bytes and write_bytes. I do get mail_read_bytes numbers but I am not sure these numbers are correct.

I there a top utility that works well so I can see email traffic from users mailboxes. The doveadm top does not work well. I also tried the perl scripts and that does not do a much better job.

Thanks Kilburn