Issue E-Mail-Security failed to pipe message to "es-learn-spam.sh"

[Puschendorf]

Server operating system version

Ubuntu 20.04.6

Plesk version and microupdate number

18.0.73

English: The email security plugin generates an error, which means that spam emails are not detected and moved. However, this only affects around 15 out of 200 email accounts. I have already checked the permissions for the folders and files.

Deutsch: Das E-Mail-Security-Plugin erzeugt einen Error und Spam-Mails werden dadurch nicht erkannt und verschoben. Das betrifft aber nur ca. 15 von 200 E-Mail-Postfächern. Die Rechte der Ordner und Dateien habe ich schon überprüft.

Error in mail.err:
Oct 28 08:14:12 xxxxx dovecot: service=imap, user=[email protected], ip=[xx.xxx.xx.xx]. Error: sieve: failed to pipe message to program 'es-learn-spam.sh': refer to server log for more information. [2025-10-28 08:14:12]
Oct 28 08:14:12 xxxxx dovecot: service=imap, user=[email protected], ip=[xx.xxx.xx.xx]. Error: sieve: Execution of script 'report-spam/es-report-spam' failed

 

[Sebahat.hadzhi]

Hello, @Puschendorf . Are the affected mailboxes significantly larger than the rest or they get abnormal amount of spam messages that are moved at once? It is possible for the issue to occur due to a timeout of the es-learn-spam.sh process.

 

[Puschendorf]

Hey Sebahat. Thanks for the quick response. A timeout error is certainly possible, but there are not a large number of spam emails. A single spam email arrives and triggers the error. The email accounts are of normal size. There were about 80 incidents in 24 hours - spread over the entire period. 14 mailboxes (out of 400) were affected.

 

[Sebahat.hadzhi]

Thank you for the confirmation. Can you please double-check /etc/dovecot/conf.d/96-email-security.conf and confirm if there is limit specified for sieve_extension_exec_timeout?

 

[Puschendorf]

No.

protocol imap {
mail_plugins {
imap_sieve = yes
}
}

sieve_plugins {
sieve_imapsieve = yes
sieve_extprograms = yes
}

sieve_global_extensions {
vnd.dovecot.pipe = yes
}

sieve_pipe_bin_dir = /usr/local/bin/dovecot-sieve
sieve_script global-after {
type = after
path = /var/qmail/popuser/es-global.sieve
}
namespace inbox {
mailbox Spam {
sieve_script report-spam {
type = before
cause = copy
path = /var/qmail/popuser/es-report-spam.sieve
}
}
imapsieve_from Spam {
sieve_script report-ham {
type = before
cause = copy
path = /var/qmail/popuser/es-report-ham.sieve
}
}
}