sieve filter not working

[Michael Williamson]

Hi,

OK. I tried your suggestion. I modified the dovecot config file
"10-logging.conf", like so:

 log_path = syslog

and

 mail_debug = yes

It appears that the logging goes to "/var/log/maillog", not "messages"
as I expected.
Restarting service dovecot produces info in the "maillog" file showing
the restart:
...
Jan 22 15:20:14 coe dovecot: imap: Server shutting down. bytes=3383/61998
Jan 22 15:20:15 coe dovecot: master: Dovecot v2.0.9 starting up (core
dumps disabled)

However, when I send a spam email to a user, the log has no dovecot messages:

Jan 22 15:11:15 coe postfix/pickup[27525]: E3CA72578F: uid=0 from=<root>
Jan 22 15:11:15 coe postfix/cleanup[27819]: E3CA72578F:
message-id=<20150122211115.E3CA72578F at coe.tsuniv.edu>
Jan 22 15:11:15 coe postfix/qmgr[10863]: E3CA72578F:
from=<root at coe.tsuniv.edu>, size=10173, nrcpt=1 (queue active)
Jan 22 15:11:16 coe amavis[27456]: (27456-07) LMTP:[127.0.0.1]:10024
/var/spool/amavisd/tmp/amavis-20150122T150549-27456-7GX8WObe:
<root at coe.tsuniv.edu> -> <mwilliamson at coe.tsuniv.edu> SIZE=10173
Recei$
Jan 22 15:11:16 coe amavis[27456]: (27456-07) Checking: nS2V0oL2RKlj
<root at coe.tsuniv.edu> -> <mwilliamson at coe.tsuniv.edu>
Jan 22 15:11:18 coe postfix/smtpd[27825]: connect from
localhost.localdomain[127.0.0.1]
Jan 22 15:11:18 coe postfix/smtpd[27825]: 86B2223871:
client=localhost.localdomain[127.0.0.1]
Jan 22 15:11:18 coe postfix/cleanup[27819]: 86B2223871:
message-id=<20150122211115.E3CA72578F at coe.tsuniv.edu>
Jan 22 15:11:18 coe postfix/smtpd[27825]: disconnect from
localhost.localdomain[127.0.0.1]
Jan 22 15:11:18 coe postfix/qmgr[10863]: 86B2223871:
from=<root at coe.tsuniv.edu>, size=10891, nrcpt=1 (queue active)
Jan 22 15:11:18 coe amavis[27456]: (27456-07) nS2V0oL2RKlj FWD from
<root at coe.tsuniv.edu> -> <mwilliamson at coe.tsuniv.edu>, BODY=7BIT 250
2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as $
Jan 22 15:11:18 coe amavis[27456]: (27456-07) Passed SPAMMY
{RelayedTaggedInbound}, <root at coe.tsuniv.edu> ->
<mwilliamson at coe.tsuniv.edu>, Message-ID:
<20150122211115.E3CA72578F at coe.tsuniv.edu>, mail_i$
Jan 22 15:11:18 coe postfix/lmtp[27821]: E3CA72578F:
to=<mwilliamson at coe.tsuniv.edu>, relay=127.0.0.1[127.0.0.1]:10024,
delay=2.8, delays=0.11/0.04/0/2.6, dsn=2.0.0, status=sent (250 2.0.0
from MTA(smt$
Jan 22 15:11:18 coe postfix/qmgr[10863]: E3CA72578F: removed
Jan 22 15:11:18 coe postfix/local[27827]: 86B2223871:
to=<mwilliamson at coe.tsuniv.edu>, relay=local, delay=0.14,
delays=0.05/0.04/0/0.04, dsn=2.0.0, status=sent (delivered to maildir)
Jan 22 15:11:18 coe postfix/qmgr[10863]: 86B2223871: removed

I attached the above snippet of log file lines to this email.

However, just watching the maillog file, dovecot messages do appear, like these:

Jan 22 15:37:12 coe dovecot: imap-login: Login: user=<burks>,
method=PLAIN, rip=::1, lip=::1, mpid=29204, TLS
Jan 22 15:37:12 coe dovecot: imap(burks): Disconnected: Logged out bytes=94/856

So, is it postfix doing the local mail delivery, not dovecot? Could
dovecot debug messages be
going to a different log file? (They are not in "/var/log/messages").

Thanks,
-Mike



On 1/22/15, Thomas Leuxner <tlx at leuxner.net> wrote:
> * Michael Williamson <michael.h.williamson at gmail.com> 2015.01.22 20:11:
>
>> I have dovecot 2.0.9 running on a CentOS 6.6 email server for a small
>
> This is a notorious version. Not only is it hopelessly outdated, it used to
> contain broken features way back...
>
>> require ["fileinto"];
>> # Move spam to spam folder
>> if header :contains "X-Spam-Flag" ["YES"] {
>>   fileinto "Maildir/.SPAM";
>>   stop;
>> }
>
> The mail is very awkwardly structured, I had trouble spotting the actual
> question FTR. You may set mail_debug to yes:
>
> $ grep mail_debug *
> 10-logging.conf:#mail_debug = no
>
> This will then produce verbose logging and most likely will help spotting
> the reason why the mail is not filed. Inject a mail with logging raised and
> post the relevant log excerpt here for further analysis. I have a feeling
> that it should just say fileinto "SPAM", but difficult to say without seeing
> log output.
>
> Current Dovecot versions also have the benefit of the sieve-test tool which
> lets you apply rules to mailboxes and see what would happen, or refilter
> mail if you're happy with the outcome of the dry-run.
>
> Regards
> Thomas
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: t1
Type: application/octet-stream
Size: 2361 bytes
Desc: not available
URL: <http://dovecot.org/pipermail/dovecot/attachments/20150122/6fc35960/attachment.obj>