Re: Scanning large-body spam

2010-03-31 Thread Adam Katz
Alex wrote: What settings do people typically have these days for the maximum scanned message size? Surprisingly, at least to me, I'm seeing spam in the 650k and 700k range, at least a few per hour, and are not scanned. Does anyone have any suggestions for optimizing the process for spam

Re: Scanning large-body spam

2010-03-31 Thread Henrik K
On Wed, Mar 31, 2010 at 11:05:57AM -0400, Adam Katz wrote: Wasn't some earlier version of SA capable of scanning just the /first/ [size] of an email? Probably harder to implement within MIME, but some control to internally truncate remaining pieces (for scanning only, like the

Re: Scanning large-body spam

2010-03-31 Thread Charles Gregory
On Wed, 31 Mar 2010, Henrik K wrote: SA 3.3 has special handling for truncated messages Excuse me for not *thinking* earlier, but it occurs to me that there is a very big drawback to *truncating* a message before passing it to SA, as opposed to my original request/suggestion to *flag*

Re: Scanning large-body spam

2010-03-31 Thread Alex
Hi, Does anyone have any suggestions for optimizing the process for spam containing just a large image that would therefore bypass the typical scanning? Should I be scanning messages that large, then? Depends on your available CPU resources.  If you always have a low load average, you can

Re: Scanning large-body spam

2010-03-31 Thread Mark Martinec
On Wednesday March 31 2010 18:05:52 Charles Gregory wrote: Excuse me for not *thinking* earlier, but it occurs to me that there is a very big drawback to *truncating* a message before passing it to SA, as opposed to my original request/suggestion to *flag* (or set a config param?) to tell SA

Re: Scanning large-body spam

2010-03-31 Thread Charles Gregory
On Wed, 31 Mar 2010, Mark Martinec wrote: and let it handle arbitrary size messages by avoiding its current paradigm of keeping the entire message in memory. Is there really a problem with the in-memory size? I would have thought the major concern was the processing time for evaluating

Re: Scanning large-body spam

2010-03-31 Thread Mark Martinec
On Wednesday March 31 2010 23:43:25 Charles Gregory wrote: Is there really a problem with the in-memory size? I would have thought the major concern was the processing time for evaluating 'full' (and rawbody?) rules on a large message Yes, sure, the main issue is with evaluating regexp

Scanning large-body spam

2010-03-30 Thread Alex
Hi, What settings do people typically have these days for the maximum scanned message size? Surprisingly, at least to me, I'm seeing spam in the 650k and 700k range, at least a few per hour, and are not scanned. Does anyone have any suggestions for optimizing the process for spam containing just

Re: Scanning large-body spam

2010-03-30 Thread Lee Dilkie
Alex wrote: Hi, What settings do people typically have these days for the maximum scanned message size? Surprisingly, at least to me, I'm seeing spam in the 650k and 700k range, at least a few per hour, and are not scanned. Does anyone have any suggestions for optimizing the process for