Spam dont move to SPAM folder

[Rouven Matthies]

Hi,

I have a problem

In Plesk, I have the "Move spam to the Spam Folder" option enabled.
However, the emails remain in Inbox.

However, they are recognized as spam

"Spam detection software, running on the system" domain.tld "Has
Identified this incoming email as possible spam. The original message
Has been attached to this so you can view it (if It Is not spam) or label
similar future email. If you have any questions, see
the administrator of the system did for details. "

The original email is attached to this text.

So seems to work spamassasin, only move to the Maildir/.Spam does not work

Have you any idea on what to do?
In the mail.log I can not find anything flashy :-(

regards
Rouven

 

[igor.A.]

could you specify following information:
- Plesk panel version and the latest MU installed
- Operating System
- Mail Server you are using

 

[Rouven Matthies]

Hi igor,
I using
Plesk Panel 12.0.18 Update #3
Debian 7.5
Postfix & dovecot

I hope this helps you

 

[igor.A.]

I see you've specified mail.log file contain nothing interesting, but plesk mail subsystem store mail logs by default here:
/var/log/maillog
could you check it?
you can also send GTUBE message from external host and post logs here.
It should containg string like

dovecot: service=lda, user=user@domain.tld, ip=[]. msgid=<messageID@domain.tld>: saved mail to INBOX.Spam

if everything is ok.
I your case it shoud be smth different.

 

[igor.A.]

could you also specify was it upgrade from previous Plesk version or clean install of 12.0.18?

 

[Rouven Matthies]

/var/log/maillog is empty

here are the Log entrys from mail.log when I send GTUBE

Jun 6 07:53:47 HOSTNAME postfix/qmgr[29041]: 7C612FC2D95: from=<info@domain.de>, size=1874, nrcpt=1 (queue active)
Jun 6 07:53:47 HOSTNAME postfix/smtpd[29067]: disconnect from localhost[127.0.0.1]
Jun 6 07:53:47 HOSTNAME postfix-local[29074]: postfix-local: from=info@domain.de, to=test@domain.de, dirname=/var/qmail/mailnames
Jun 6 07:53:47 HOSTNAME spamd[11430]: spamd: connection from localhost [127.0.0.1] at port 36528
Jun 6 07:53:47 HOSTNAME spamd[11430]: spamd: using default config for test@domain.de: /var/qmail/mailnames/domain.de/test/.spamassassin/user_prefs
Jun 6 07:53:47 HOSTNAME spamd[11430]: spamd: processing message <1452652658.5.1402034027491.open-xchange@domain.de> for test@domain.de:30
Jun 6 07:53:48 HOSTNAME spamd[11430]: spamd: identified spam (997.2/5.0) for test@domain.de:30 in 0.7 seconds, 2288 bytes.
Jun 6 07:53:48 HOSTNAME spamd[11430]: spamd: result: Y 997 - ALL_TRUSTED,BAYES_00,DKIM_SIGNED,GTUBE,HTML_MESSAGE,TVD_SPACE_RATIO scantime=0.7,size=2288,user=test@domain.de,uid=30,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=36528,mid=<1452652658.5.1402034027491.open-xchange@domain.de>,bayes=0.000000,autolearn=no
Jun 6 07:53:48 HOSTNAME spamd[11428]: prefork: child states: II
Jun 6 07:53:48 HOSTNAME dovecot: imap-login: Login: user=<test@domain.de>, method=PLAIN, rip=IP ADDRESS, lip=IP ADDRESS, mpid=29080, TLS, session=<QpY8fCT7uwBRHpgS>
Jun 6 07:53:48 HOSTNAME dovecot: imap-login: Login: user=<test@domain.de>, method=PLAIN, rip=IP ADDRESS, lip=IP ADDRESS, mpid=29081, TLS, session=<uMQ8fCT7vABRHpgS>
Jun 6 07:53:48 HOSTNAME postfix-local[29074]: handlers_stderr: STOP
Jun 6 07:53:48 HOSTNAME postfix-local[29074]: STOP during call 'spam' handler
Jun 6 07:53:48 HOSTNAME postfix-local[29074]: message discarded by a mail handler
Jun 6 07:53:48 HOSTNAME postfix/pipe[29073]: 7C612FC2D95: to=<test@domain.de>, relay=plesk_virtual, delay=1.2, delays=0.15/0.01/0/1, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Jun 6 07:53:48 HOSTNAME postfix/qmgr[29041]: 7C612FC2D95: removed
Jun 6 07:53:49 HOSTNAME dovecot: imap-login: Login: user=<info@domain.de>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=29083, TLS, session=<pUdEfCT7eQB/AAAB>

 

[Rouven Matthies]

That was a Update from 11.5

 

[Rouven Matthies]

i have send you a PM with the mail.log entry when I send the GTUBE
the /var/log/maillog ist empty

 

[igor.A.]

try to use

# /usr/local/psa/admin/sbin/mchk --with-spam

 

[Rouven Matthies]

there i became these errors:

==> Checking for: mail_imap_restore...
2014 Jun 6 09:09:07 HOSTNAME anvil: Fatal: Error reading configuration: read(/var/run/dovecot/config) failed: Connection reset by peer
2014 Jun 6 09:09:07 HOSTNAME ssl-params: Fatal: Error reading configuration: read(/var/run/dovecot/config) failed: Connection reset by peer

ls -l /var/run/dovecot
srw------- 1 root root 0 Jun 6 09:09 anvil
srw------- 1 root root 0 Jun 6 09:09 anvil-auth-penalty
srw------- 1 dovecot root 0 Jun 6 09:09 auth-client
srw------- 1 dovecot root 0 Jun 6 09:09 auth-login
srw------- 1 root root 0 Jun 6 09:09 auth-master
-rw------- 1 root root 32 Jun 2 13:41 auth-token-secret.dat
srw-rw-rw- 1 popuser popuser 0 Jun 6 09:09 auth-userdb
srw------- 1 dovecot root 0 Jun 6 09:09 auth-worker
srw------- 1 root root 0 Jun 6 09:09 config
srw------- 1 root root 0 Jun 6 09:09 dict
srw------- 1 root root 0 Jun 6 09:09 director-admin
srw-rw-rw- 1 root root 0 Jun 6 09:09 dns-client
srw------- 1 root root 0 Jun 6 09:09 doveadm-server
lrwxrwxrwx 1 root root 25 Jun 6 09:09 dovecot.conf -> /etc/dovecot/dovecot.conf
drwxr-xr-x 2 root root 40 Jun 2 13:18 empty
srw-rw-rw- 1 root root 0 Jun 6 09:09 imap-urlauth
srw------- 1 dovecot root 0 Jun 6 09:09 imap-urlauth-worker
srw-rw-rw- 1 root root 0 Jun 6 09:09 indexer
srw------- 1 dovecot root 0 Jun 6 09:09 indexer-worker
srw------- 1 root root 0 Jun 6 09:09 ipc
srw------- 1 root root 0 Jun 6 09:09 log-errors
drwxr-x--- 2 root dovenull 160 Jun 6 09:09 login
-rw------- 1 root root 5 Jun 6 09:09 master.pid
-rw-r--r-- 1 root root 9 Jun 6 09:09 mounts
srw------- 1 root root 0 Jun 6 09:09 replication-notify
prw------- 1 root root 0 Jun 6 09:09 replication-notify-fifo
srw------- 1 dovecot root 0 Jun 6 09:09 replicator
srw-rw-rw- 1 root root 0 Jun 6 09:09 ssl-params
srw------- 1 root root 0 Jun 6 09:09 stats
prw------- 1 root root 0 Jun 6 09:09 stats-mail
drwxr-x--- 2 root dovenull 80 Jun 6 09:09 token-login

 

[igor.A.]

Did you install dovecot via autoinstaller?
Could you show the output for the following command:

# dpkg -l |grep -i dovecot

 

[Rouven Matthies]

Yes I installed it with the Plesk Installer

ii plesk-dovecot 2.2.12-debian7.0.build1200140527.14 amd64 Dovecot v2.2.12 secure IMAP and POP3 server
ii plesk-dovecot-core 2.2.12-debian7.0.build1200140527.14 amd64 Dovecot v2.2.12 secure IMAP and POP3 server core files
ii plesk-dovecot-imap-driver 12.0.18-debian7.0.build1200140529.21 amd64 Parallels Plesk v12.0.18 Dovecot driver
ii plesk-dovecot-pigeonhole 0.4.2-debian7.0.build1200140527.14 amd64 Sieve filters support and secure ManageSieve server for Dovecot v0.4.2

 

[igor.A.]

more commands to show output:

# cd /var/qmail/mailnames/<domain-name>/<mailbox-name>/
# cat .spamassassin/user_prefs
# tail -n 10 /etc/mail/spamassassin/local.cf
# find -type d
# /usr/local/psa/admin/sbin/mail_handlers_control --list --json | grep '<mailbox-name>@<domain-name>' -A 4 -B 6

 

[Rouven Matthies]

cat .spamassassin/user_prefs
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.
required_score 5.0
rewrite_header subject

tail -n 10 /etc/mail/spamassassin/local.cf
# and a well-trained bayes DB can save running rules, too
#
# shortcircuit BAYES_99 spam
# shortcircuit BAYES_00 ham
endif # Mail::SpamAssassin:lugin::Shortcircuit
rewrite_header subject ***SPAM***
required_score 5.0

/usr/local/psa/admin/sbin/mail_handlers_control --list --json | grep '<mailbox-name>@<domain-name>' -A 4 -B 6
-B 6
{
"queue": "before-local",
"type": "recipient",
"enabled": true,
"priority": 10,
"name": "spam",
"address": "name@domain.de",
"executable": "/opt/psa/handlers/hooks/spam",
"context": "move",
"protected": false
},

when i delete the user_prefs, the Problem is solved

 

[Rouven Matthies]

have anybody another solution?