Dovecot sieve not processing messages

After recently getting amavis to correctly tag messages, they're coming through with appropriate X-Spam-Flag: YES headers. I've set up dovecot with the sieve protocol:

protocol managesieve {
  # Login executable location.
  login_executable = /usr/lib/dovecot/managesieve-login

  # MANAGESIEVE executable location. See IMAP's mail_executable above for 
  # examples how this could be changed.
  mail_executable = /usr/lib/dovecot/managesieve

  # Maximum MANAGESIEVE command line length in bytes. This setting is 
  # directly borrowed from IMAP. But, since long command lines are very
  # unlikely with MANAGESIEVE, changing this will not be very useful.  
  #managesieve_max_line_length = 65536

  # Specifies the location of the symlink pointing to the active script in
  # the sieve storage directory. This must match the SIEVE setting used by
  # deliver (refer to http://wiki.dovecot.org/LDA/Sieve#location for more
  # info). Variable substitution with % is recognized.
  sieve=/var/mail/%d/%n/.dovecot.sieve

  # This specifies the path to the directory where the uploaded scripts must
  # be stored. In terms of '%' variable substitution it is identical to
  # dovecot's mail_location setting used by the mail protocol daemons.
  sieve_storage=/var/mail/%d/%n/sieve

  # If, for some inobvious reason, the sieve_storage remains unset, the 
  # managesieve daemon uses the specification of the mail_location to find out 
  # where to store the sieve files (see explaination in README.managesieve). 
  # The example below, when uncommented, overrides any global mail_location 
  # specification and stores all the scripts in '~/mail/sieve' if sieve_storage 
  # is unset. However, you should always use the sieve_storage setting.
  # mail_location = mbox:~/mail

  # To fool managesieve clients that are focused on timesieved you can
  # specify the IMPLEMENTATION capability that the dovecot reports to clients 
  # (default: dovecot).
  #managesieve_implementation_string = Cyrus timsieved v2.2.13
}

I can see that managesieve-login is running. managesieve is not. The file does exist. Any ideas on where to start? Enabling mail_debug = yes doesn't seem to tell me anything useful.