On 7/20/2010 11:55 PM, Daniel Lemke wrote:
Gnanam wrote:
Ted Mittelstaedt-2 wrote:
Generally, no. SA skips messages that are larger than a size that you
set in the config file. Most attachments are larger than that size.
Obviously if you have a really small attachment then it will scan it.
Thanks for that update.
Assuming my use case need to do test/scan on attachments as well, thereby
I set a large size in the config file, say 5 MB for example. I also
understand that it will take few more seconds to test/scan.
How does SA scan binary attachments like .doc, .docx, .rtf, .xls, .zip,
etc. in that case?
As far as I know SpamAssassin looks for the mime type of the message, if
it's text/xyz it will perform a scan. Be careful in pushing the message size
limit! As said before, it doesn't make sense to set it to such a large
value, as spammers WILL NOT send spam messages of that size (it's just to
expensive in terms of hardware/traffic).
To hijack the thread: Does anyone know an optimum for message size limit?
Ours is set to 2MB at the moment, but we have problems when receiving large
text mails (e.g. more than 1MB) as the message check will become REALLY time
consuming. This leads to a curious situation where our Exchange (or maybe
it's the external mail server, not sure of that) sends the message again
after ~55 seconds, so the next child begins checking the mail... And there
we've got a loop (until the server runs out of memory)...
I set the --timeout-child of spamd to 45 secs now, what's working as a
workaround for now, but there may exist a more solid solution, is that
correct?
We use the stock default which is 250k and it's fine. I would not go
over 1M, frankly. Consider that in the time a spammer can send a 2MB
spam, they can send 64 64k messages, and even 64k is a huge bit of text
to get your hair tonic message across. A single typed page is
around 4k.
Keep in mind the larger the size of the spam message the more material
that there is for a content filter to chew on. A 250k message is going
to have so many repetitions of "pecker" and "bottomless fagina" and
god-knows what else in it, that it makes it easy-pickings for a content
filter like SA to match all sorts of stuff in there.
I know that I probably sound like a broken record but if you run log
analysis of your mailserver you will get a breakdown of sizes. Please,
go here:
http://www.klake.org/sma/
download, install, you get a pretty report like this:
http://www.klake.org/sma/example.html
get your average message size out of there and off you go. Ours is
around 50K
There are other, better, analysis packages out there but that ought
to get you started.
Ted
