> To make sure I understand how encoded attachments are scanned... If a base64 > encoded attachment is 12000 lines long, does each body_checks pattern get > run on each of the 12000 lines? Or does each body_checks pattern get run > just once on the first x bytes of the encoded attachment?
OLD postfix: each body check pattern was run on each line of the message body, which would include the 12000 line attachment. NEWer postfix: each body check pattern is run on each line in the body_checks_size_limit of the message body. NOTE: body_checks_size_limit is a measure of bytes, not lines. So the default body_checks_size_limit of 51200 is 50k of the message. Off hand I do not know where they start that 50k count, but I would bet it is from the start of the data command. So if you had a 90k or 900k attachment, a bit less than 50k of this would be checked. That is because the headers from the last hop, including hops, subject, to, from, X-Whatevers, and so on, plus the text part of the message, will be above the attachment. I would wager that all this information rarely exceeds 5k all told. And that is with a good sized text message! --Eric
