Hehe sure. Here would be the output of dovecot -n on my maibox server:

# 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 ext4 auth_master_user_separator = * auth_mechanisms = plain login cram-md5 disable_plaintext_auth = no first_valid_uid = 150 last_valid_uid = 150 login_trusted_networks = X.Y.Z.X mail_location = maildir:/var/vmail/%d/%n/Maildir mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { antispam_backend = pipe antispam_pipe_program = /usr/bin/spamc antispam_pipe_program_args = -d;my-mx-server.domain.com;-u;amavis antispam_pipe_program_notspam_args = -L;ham antispam_pipe_program_spam_args = -L;spam antispam_pipe_tmpdir = /tmp antispam_signature = X-Spam-Flag antispam_signature_missing = error antispam_spam = INBOX.Spam;INBOX.Junk antispam_trash = INBOX.trash;trash;INBOX.Trash;Trash;INBOX.Deleted Items;Deleted Items;INBOX.Deleted Messages;Deleted Messages antispam_verbose_debug = 1 quota = maildir:User quota quota_rule = *:storage=1G quota_rule2 = INBOX.Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_after = /etc/dovecot/sieve/after.d sieve_before = /etc/dovecot/sieve/before.d sieve_dir = ~/sieve } postmaster_address = postmaster@domain.com protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 12345 } } service imap { process_limit = 4096 } service lmtp { inet_listener lmtp { port = 24 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl_cert =

On Wednesday, January 14, 2015 9:06 PM, Pascal Volk user+dovecot@localhost.localdomain.org wrote: On 01/14/2015 03:05 PM, ML mail wrote:

Hello,

I am using the antispam plugin of Dovecot with SpamAssassin and in some cases when users move back mails from the Spam folder to their INBOX (false positive) they get the following error message:

[SERVERBUG] failed to send mail

Does anyone have an idea what could be the issue here? It is quite annoying as the mail then stays in the Spam folder and can not been re-learnt has ham.

Someone has stolen my crystal ball. :-( Please provide doveconf -n output.

Regards, Pascal

The trapper recommends today: beeffeed.1501421@localdomain.org

Thank you for your helpful hints on debugging this issue. I wanted first to get the mail which generates this error but unfortunately the user already deleted it as well from his trash. Now I got another hint and it looks like this mail had a big attachment to it. Is it possible that spamc generated this error due to the size of the mail?

Regards ML

On Thursday, January 15, 2015 8:29 AM, Steffen Kaiser skdovecot@smail.inf.fh-brs.de wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

On Thu, 15 Jan 2015, ML mail wrote:

It would be better to have the original question & discussion at the top, so one could cut and read nicely,

On Wednesday, January 14, 2015 9:06 PM, Pascal Volk user+dovecot@localhost.localdomain.org wrote: On 01/14/2015 03:05 PM, ML mail wrote:

...

Hello,

I am using the antispam plugin of Dovecot with SpamAssassin and in some cases when users move back mails from the Spam folder to their INBOX (false positive) they get the following error message:

[SERVERBUG] failed to send mail

# 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-4-amd64 x86_64 Debian 7.8 ext4

[cut]

plugin { antispam_backend = pipe antispam_pipe_program = /usr/bin/spamc antispam_pipe_program_args = -d;my-mx-server.domain.com;-u;amavis antispam_pipe_program_notspam_args = -L;ham antispam_pipe_program_spam_args = -L;spam antispam_pipe_tmpdir = /tmp antispam_signature = X-Spam-Flag antispam_signature_missing = error antispam_spam = INBOX.Spam;INBOX.Junk antispam_trash = INBOX.trash;trash;INBOX.Trash;Trash;INBOX.Deleted Items;Deleted Items;INBOX.Deleted Messages;Deleted Messages antispam_verbose_debug = 1

What does the Plugin log?

[cut]

service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail }

You seem to use a virtual user configuration, so the antispam plugin executes spamc as user vmail, correct?

What happens if you run the program manually? sudo -u vmail /usr/bin/spamc -d my-mx-server.domain.com -u amavis -L ham \ < message

You can also trace the program with a wrapper script. Replace antispam_pipe_program with /usr/local/bin/spamc-wrapper

==== BEGIN /usr/local/bin/spamc-wrapper #/bin/bash

( # when and who date;id; let i=0 # what echo /usr/bin/spamc "$@" # see embedded spaces in arguments for arg; do let i=i+1 echo "Arg#$i: '$arg'" done # call original program

/usr/bin/spamc "$@" # log return code / exit code rc=$? echo rc=$rc # Make sure the rc is returned back to caller exit $rc

# log everything into a file ) >>/tmp/spamc-wrapper.log 2>&1 ==== END

If you have lots of simultaneous calls, create one log file per call -> add .$$ to filename.

Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQEVAwUBVLdsenz1H7kL/d9rAQI5wQf/R/8IIWAgcLX8061FBI5gFxEH8jP8UVMb MoSkkRT88teQJYuDxjr8zA92MX/2HDruRstzwxgJ1WxPefOvETpzGs1wrFqtWABM 2qB/ENfmkyOgmvpfsX5j6armYgOGEK0j5lf/ulV2i110wAJqjWY+9hBekFs7g4Th j29D42kv5Tl0XVwJbbYfzH/gUB+kyLxV7ja3dWWmmRRNV9am4Du36zua5AB2BzYq kuSqXfxClbnRYA/Ajy8H1KYhmx8wRtjkNijxt8B7R5f04E8hLrFVd5lKZIieuO6e oNu45xHeW3mYas0I3jWBf0u5pt1XlP7RLOtdB3D15CsW42PPsDcKxw== =Beji -----END PGP SIGNATURE-----

Am 16.01.2015 um 09:46 schrieb ML mail:

Thanks to your help Steffen I was able to find out the issue which was simply the size of the Spam mail as you can see here:

spamc[16545]: skipped message, greater than max message size (512000 bytes)

The spam mail was around 900 kbytes as such I have changed the spamc limit to 1MB. Bastard spammer who abuses this limit by attaching a big image...

that's common for years now, even as we used a Barracuda Networks device where you need to add &expert=1 in the extended settings to raise that limit

given that only a small amount makes it to SA here i increased that to 5 MB, in case of large images there is no performance impact, only large messages with most plaintext are ressource hungry to scan

in fact i have seen such bastards attach 2 MB images to the typical spam mailbody to bypass scanners