Due to out zimbra implementation being a migration from an existing server with hundreds of users all using pop-before-smtp, we were require to enable this tool as well. Everything from the mnxsolutions blog posting above worked fine except that the INFO multiline authentication patterns did not catch IMAP logins, so we changed them to the following and everything appears to be working correctly, both POP3 and IMAP:
$PID_pat = '^[LOGTIME],\d+\ INFO \[(?:Pop3|Imap)[A-Za-z]+-(\d+)\] ';
$IP_pat = $PID_pat . '[\S\s]+(?:\[|=)(\d+\.\d+\.\d+\.\d+)[\S\s]+ connected';
$OK_pat = $PID_pat . '[\S\s]+name=[A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4}[\S\s]+(?
op|imap) \- user [A-Za-z0-9._%-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4} authenticated, mechanism=[A-Za-z]+';