Hi Ben,

thank you for your quick answer.

"doesn't work" should mean, the message is delivered to the INBOX. There is only one quite simple sieve-script for this user (generated by roundcube). Here's the complete script:

require ["regex","fileinto"]; # rule:[move INVALID HEADER] if header :regex "Subject" "^INVALID HEADER" { fileinto "INVALID HEADER"; } # rule:[move Cron] if header :regex "Subject" "^Cron <root@amavisd>" { fileinto "Cron"; }

All messages are delivered with lmtp and generated by amavisd-new in this case. I've no .dovecot.sieve.log in the users home dir. Can I activate it or will it appear only in case of sieve errors? I can't find any difference between the messages. Maybe you can have a look:

-------------------- message delivered to INBOX (nok) -------------------- Return-Path: <virusadmin@****.net> Received: from mail.****.net ([*.*.*.*]) by dovecot.****.net (Dovecot) with LMTP id /zSOLkVrvFBjDQAAfopj6Q ; Mon, 03 Dec 2012 10:05:09 +0100 Received: from localhost (unknown [192.168.12.27]) by mail2.****.net (Postfix) with ESMTP id 47922154A6A for <virusadmin@****.net>; Mon, 3 Dec 2012 10:05:09 +0100 (CET) Content-Type: multipart/mixed; boundary="----------=_1354525509-3680-1" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 From: "Mail-Security" <virusadmin@****.net> Date: Mon, 3 Dec 2012 10:05:09 +0100 (CET) Subject: INVALID HEADER in mail FROM LOCAL [172.16.105.182]:57392 <root@intrasrv03.localdomain> To: <virusadmin@****.net> Message-ID: <VAEWdUiMCcvfCl@amavisd.****.net>

This is a multi-part message in MIME format...

------------=_1354525509-3680-1 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable

No viruses were found.

Bad header: Non-encoded 8-bit data (char E1 hex): Subject: ... Jose Sousa# Lista compar\341vel de vendas m[...] Content type: BadHdr8bit Internal reference code for the message is 03680-12/EWdUiMCcvfCl

-------------------- message delivered to "INVALID HEADER" (ok)

Return-Path: <virusadmin@****.net> Received: from mail.****.net ([*.*.*.*]) by dovecot.****.net (Dovecot) with LMTP id LlmtN9abvFDWEgAAfopj6Q ; Mon, 03 Dec 2012 13:35:03 +0100 Received: from localhost (unknown [192.168.12.27]) by mail2.****.net (Postfix) with ESMTP id 5D301154E45 for <virusadmin@****.net>; Mon, 3 Dec 2012 13:35:03 +0100 (CET) Content-Type: multipart/mixed; boundary="----------=_1354538103-7835-0" Content-Transfer-Encoding: 7bit MIME-Version: 1.0 From: "Mail-Security" <virusadmin@****.net> Date: Mon, 3 Dec 2012 13:35:03 +0100 (CET) Subject: INVALID HEADER in mail FROM LOCAL [172.16.105.182]:44981 <root@intrasrv03.localdomain> To: <virusadmin@****.net> Message-ID: <VA8PpOmsB88Xzl@amavisd.****.net>

This is a multi-part message in MIME format...

------------=_1354538103-7835-0 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable

No viruses were found.

Bad header: Non-encoded 8-bit data (char FC hex): Subject: ZFIAS-Fehler: Direktion T\374rkei# 151#Umsa[...] Content type: BadHdr8bit Internal reference code for the message is 07835-12/8PpOmsB88Xzl

Am 03.12.2012 09:55, schrieb Ben Morrow:

At 9AM +0100 on 3/12/12 you (Daniel Funke) wrote:

...

I have a sieve filter for a mailbox with amavisd-admin mails.

if header :regex "Subject" "^INVALID HEADER" { fileinto "INVALID HEADER"; }

After the upgrade to dovecot 2.1.12 this filter doesn't work for some (16) messages with this subject. For 424 messages it worked correct. What does 'doesn't work' mean? Was the message delivered to the INBOX, was it thrown away, did something else happen?

Is there anything else in the sieve script, or any other sieve scripts, that might be affecting what happens?

...

Any ideas where to look? Start by looking in the main dovecot log to make sure the messages were actually delivered by dovecot-lda (rather than by your mail server's own LDA, for instance). Then check the .dovecot.sieve.log file in the user's home directory for any sieve errors.

If it doesn't become apparent what's going on from that, then you will need to find a way to reproduce this. Look at the messages which failed and the messages which didn't, and see if you can see some common difference.

Ben