Quoting Rick Romero <r...@havokmon.com>:
I found something interesting via strace. lda is writing a timestamp with utime before doign the fsync, but I'm really not a C guy, so I have no idea why that's going on via procmail and not via commandline. I assume it's related to the choice of pread64 vs read.
Got it. Working: connect(6, {sa_family=AF_FILE, path="/var/run/dovecot/config"}, 110) = 0 NonWorking: connect(6, {sa_family=AF_FILE, path="/var/run/dovecot/config"}, 110) = -1 EACCES (Permission denied) /var/run/dovecot/config was owned by root. I changed it to vpopmail (which procmail runs under), and my timestamps are now correct. Rick