splitting messages/duplicate messages - was Re: Upgrade Oddity -

[Ken Anderson (Pacific Internet)]

References: <9BDD6D4AD0795C46974D7D46C17883B809FC3C13 at ahm_exchange2.americanhm.com>            <4048BDB9.8060203 at pacific.net> <2D63C1DA-6ED4-11D8-B24D-003065F939FE at ucsc.edu>
In-Reply-To: <2D63C1DA-6ED4-11D8-B24D-003065F939FE at ucsc.edu>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.38


I was referring to the explosion of message parts, not archives.

I'd like to see a setting for max part explosion too, or something like
that, though I'm not sure exactly how all the code in Message.pm works,
so it's a bit unclear to me if that's possible or a good idea.

Our problem is compounded by the fact that we split recipients in
sendmail, so if a message comes in with 10 recipients, it's split into
10 messages. If it also contains 5 poorly formed mime parts, MailScanner
4.26.7+ will split it up again. So we end up passing 5 parts of 1
message to SpamAssassin 10 times = 50x. :-(

It would be nice if there was a way for SA to checksum a message, store
it's SA score and apply that score to subsequent duplicate copies that
pass through SA within a limited amount of time. This would help with
dictionary attacks too.

Anyone working on such a thing?
Does it make sense?
Thanks,

Ken A.
Pacific.Net


John Rudd wrote:

> On Mar 5, 2004, at 9:49 AM, Ken Anderson (Pacific Internet) wrote:
>
>> We process about 3x the amount of mail on a similar machine, and are
>> unable to run 4.26.8-1. Changes in Message.pm, particularly in it's
>> expansion of message parts make it slower than previous versions. It's
>> much better at detecting viruses hidden in poorly formed mime parts, so
>> it's a problem I'm hoping for a solution to as well.
>
>
> Does it help if you set the maximum archive depth to 0, or are you not
> talking about expansion of archives, but expansion of something else?
>
>