Monitoring the logins and connecting Ip's


I saw few weired ip in the mail log that that tried to login attempts to the admin account.
Most of them were tor end points. I am not sure that the login were successful or not.
I wanted to know

  1. Which log file and what key words should I look for to see successful logins ?
  2. How can I see the successful log of the sent mails ?
  3. In mail log I see few logins attempt from different tor end point ip’s

mail log dovecot: imap-login: Login: user=, method=PLAIN, rip=, lip=XXX.XXX.XXX.XXX, mpid=20771, TLS, session=
dovecot: imap(XXXXX): Warning: autocreate plugin is deprecated, use mailbox { auto } setting instead

Does this mean a successful login from