Particular emails forcing SA timeouts

[Marcel Burggraeve]

Some time ago we've had the 'same kind' of problems.
We started with some timeouts but the amount of timeouts kept growing and
growing.
After a while something like 75% of all spam got through due to timeouts.
When we tried to do an expire on the bayes database we kept on getting the
'something fishy' notice.
Finally we decided to delete all bayes_* files and rebuild them with
sa-learn.
After this our timeouts we're all gone.

Best regards,

Marcel Burggraeve
Plusine


> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
> Behalf Of Steve Campbell
> Sent: donderdag 2 september 2004 15:14
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Particular emails forcing SA timeouts
>
>
> I have recently starting seeing a lot of graphical porn coming through due
> to what appears to be SA timeouts. I can only assume something in these
> emails are forcing the timeouts. They all seem to have similar headers as
> below: This seems to be the only email that is getting the timeouts.
>
>
> MIME-Version: 1.0
> Content-Type: text/html
> Content-Transfer-Encoding: base64
> X-CN-MailServer2-MailScanner-Information: Please contact the ISP for more
> information
> X-CN-MailServer2-MailScanner: Found to be clean
> X-CN-MailServer2-MailScanner-SpamCheck: not spam, SpamAssassin (timed out)
> X-MailScanner-From: dwyerju at sculptyourtiny.com
> Status:
>
> They seem to be incomplete as this is the way this ends.
>
> The logs for this message indicate:
>
> Sep  2 07:47:12 mailserver2 MailScanner[12305]: Content Checks:
> Detected and
> will
> disarm HTML message in i82BjnJn027100
>
> I am running MS version 4.31.6-1 and SA 2.63-1
>
> Is anyone else seeing this and does anyone have a clue?
>
> Thanks
>
> Steve Campbell
> campbell at cnpapers.com
> Charleston Newspapers
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).