search for: cancelled_write_bytes

Hi, I have being try to track down top email users to sometime. When I do a network traffic check I can see there is about 15 times more email traffic pulled from mail server than sent. The problem I am trying to track down is which users are the culprit. I have enabled doevcot stats and I can do a doveadm stats dump user but I get a 0 for disk_input, disk_output, read_bytes and write_bytes. I