sieve filter not working

[Christian Kivalo]

On 2015-01-22 22:41, Michael Williamson wrote:
> Hi,
Hello,

> 
> OK. I tried your suggestion. I modified the dovecot config file
> "10-logging.conf", like so:
> 
>  log_path = syslog
> 
> and
> 
>  mail_debug = yes
> 
You could set

syslog_facility = local5

and have all the log messages in the messages file.

Also take a look at the logging dovecot wiki page

http://wiki2.dovecot.org/Logging

> It appears that the logging goes to "/var/log/maillog", not "messages"
> as I expected.
> Restarting service dovecot produces info in the "maillog" file showing
> the restart:
> ...
> Jan 22 15:20:14 coe dovecot: imap: Server shutting down. 
> bytes=3383/61998
> Jan 22 15:20:15 coe dovecot: master: Dovecot v2.0.9 starting up (core
> dumps disabled)
> 
> However, when I send a spam email to a user, the log has no dovecot 
> messages:
> 
> Jan 22 15:11:15 coe postfix/pickup[27525]: E3CA72578F: uid=0 
> from=<root>
> Jan 22 15:11:15 coe postfix/cleanup[27819]: E3CA72578F:
> message-id=<20150122211115.E3CA72578F at coe.tsuniv.edu>
> Jan 22 15:11:15 coe postfix/qmgr[10863]: E3CA72578F:
> from=<root at coe.tsuniv.edu>, size=10173, nrcpt=1 (queue active)
> Jan 22 15:11:16 coe amavis[27456]: (27456-07) LMTP:[127.0.0.1]:10024
> /var/spool/amavisd/tmp/amavis-20150122T150549-27456-7GX8WObe:
> <root at coe.tsuniv.edu> -> <mwilliamson at coe.tsuniv.edu> SIZE=10173
> Recei$
> Jan 22 15:11:16 coe amavis[27456]: (27456-07) Checking: nS2V0oL2RKlj
> <root at coe.tsuniv.edu> -> <mwilliamson at coe.tsuniv.edu>
> Jan 22 15:11:18 coe postfix/smtpd[27825]: connect from
> localhost.localdomain[127.0.0.1]
> Jan 22 15:11:18 coe postfix/smtpd[27825]: 86B2223871:
> client=localhost.localdomain[127.0.0.1]
> Jan 22 15:11:18 coe postfix/cleanup[27819]: 86B2223871:
> message-id=<20150122211115.E3CA72578F at coe.tsuniv.edu>
> Jan 22 15:11:18 coe postfix/smtpd[27825]: disconnect from
> localhost.localdomain[127.0.0.1]
> Jan 22 15:11:18 coe postfix/qmgr[10863]: 86B2223871:
> from=<root at coe.tsuniv.edu>, size=10891, nrcpt=1 (queue active)
> Jan 22 15:11:18 coe amavis[27456]: (27456-07) nS2V0oL2RKlj FWD from
> <root at coe.tsuniv.edu> -> <mwilliamson at coe.tsuniv.edu>, BODY=7BIT 250
> 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as $
> Jan 22 15:11:18 coe amavis[27456]: (27456-07) Passed SPAMMY
> {RelayedTaggedInbound}, <root at coe.tsuniv.edu> ->
> <mwilliamson at coe.tsuniv.edu>, Message-ID:
> <20150122211115.E3CA72578F at coe.tsuniv.edu>, mail_i$
> Jan 22 15:11:18 coe postfix/lmtp[27821]: E3CA72578F:
> to=<mwilliamson at coe.tsuniv.edu>, relay=127.0.0.1[127.0.0.1]:10024,
> delay=2.8, delays=0.11/0.04/0/2.6, dsn=2.0.0, status=sent (250 2.0.0
> from MTA(smt$
> Jan 22 15:11:18 coe postfix/qmgr[10863]: E3CA72578F: removed
> Jan 22 15:11:18 coe postfix/local[27827]: 86B2223871:
> to=<mwilliamson at coe.tsuniv.edu>, relay=local, delay=0.14,
> delays=0.05/0.04/0/0.04, dsn=2.0.0, status=sent (delivered to maildir)
> Jan 22 15:11:18 coe postfix/qmgr[10863]: 86B2223871: removed
> 
> I attached the above snippet of log file lines to this email.
> 
> However, just watching the maillog file, dovecot messages do appear, 
> like these:
> 
> Jan 22 15:37:12 coe dovecot: imap-login: Login: user=<burks>,
> method=PLAIN, rip=::1, lip=::1, mpid=29204, TLS
> Jan 22 15:37:12 coe dovecot: imap(burks): Disconnected: Logged out 
> bytes=94/856
> 
> So, is it postfix doing the local mail delivery, not dovecot? Could
> dovecot debug messages be
> going to a different log file? (They are not in "/var/log/messages").
> 
To answer this question please post relevant parts of your postfix 
main.cf
- mailbox_command
- virtual_transport
- mailbox_transport

I use lmtp delivery from postfix to dovecot with virtual users as 
described in

http://wiki2.dovecot.org/HowTo/PostfixDovecotLMTP

and that works very well.

> Thanks,
> -Mike

- christian

> 
> 
> 
> On 1/22/15, Thomas Leuxner <tlx at leuxner.net> wrote:
>> * Michael Williamson <michael.h.williamson at gmail.com> 2015.01.22 
>> 20:11:
>> 
>>> I have dovecot 2.0.9 running on a CentOS 6.6 email server for a small
>> 
>> This is a notorious version. Not only is it hopelessly outdated, it 
>> used to
>> contain broken features way back...
>> 
>>> require ["fileinto"];
>>> # Move spam to spam folder
>>> if header :contains "X-Spam-Flag" ["YES"] {
>>>   fileinto "Maildir/.SPAM";
>>>   stop;
>>> }
>> 
>> The mail is very awkwardly structured, I had trouble spotting the 
>> actual
>> question FTR. You may set mail_debug to yes:
>> 
>> $ grep mail_debug *
>> 10-logging.conf:#mail_debug = no
>> 
>> This will then produce verbose logging and most likely will help 
>> spotting
>> the reason why the mail is not filed. Inject a mail with logging 
>> raised and
>> post the relevant log excerpt here for further analysis. I have a 
>> feeling
>> that it should just say fileinto "SPAM", but difficult to say without 
>> seeing
>> log output.
>> 
>> Current Dovecot versions also have the benefit of the sieve-test tool 
>> which
>> lets you apply rules to mailboxes and see what would happen, or 
>> refilter
>> mail if you're happy with the outcome of the dry-run.
>> 
>> Regards
>> Thomas
>>