What I wanted was an IMAP-folder called “Report-as-spam” and mail that I move into that folder would be reported ad spam via “spamassassin -r” and then deleted.

I have a setup with Dovecot as IMAP-server and Dovecot is configured to use maildir as its mailstorage format. As opposed to your Cyrus the event from Dovecot is actually MOVED_TO when the mail is moved from $MAILDIR/tmp to $MAILDIR/current.

I used incron (http://inotify.aiken.cz/?section=incron&page=about&lang=en) to run a shell-script that reports and deletes the mail.

My incrontab is (one line):

/var/maildir/arne/.Report-as-spam/cur IN_MOVED_TO /home/arne/usr/bin/report-as-spam $#

A few lessons I learned was that there should be one and only one space between the event and the command. And incron doesn’t have a build the shell like syntax like cron — so don’t use “spamassassin -r && rm $@/$#” as the command.

My report-as-spam shell script is (don’t know if it will bw shown correctly — but there nothing spooky in there):

#!/bin/sh
SPAMFILE=/var/maildir/arne/.Report-as-spam/cur/$1
if [[ -f $SPAMFILE ]]; then
/usr/bin/spamassassin -r $SPAMFILE && rm $SPAMFILE && logger Reported $SPAMFILE as spam
fi