"too big for spam checks"

[Paul Lamb]

 >Date: Wed, 25 Feb 2009 12:01:52 -0800
 >From: Scott Silva <ssilva at sgvwater.com>
 >
 >on 2-25-2009 11:14 AM Paul Lamb spake the following:
 >>
 >> I have noticed a number of MailScanner messages in /var/log/messages
 >> of the form:-
 >>
 >> MailScanner: Message <number> from ... is too big for spam check
 >>
 >> Such messages are dropped which I find surprising as the comments in
 >> MailScanner.conf against Max Spam Check Size include:-
 >>         # ...if a message is bigger than a certain size, it
 >>         # is highly unlikely to be spam. Limiting this saves
 >>         # a lot of time checking huge messages.
 >>
 >> This suggests to me that larger messages should be accepted. I
 >> believe that this was the case with the last versions of
 >> MailScanner/Spamassassin that I used).
 >>
 >> The few messages to the list about this error message do not
 >> explicitly answer these two questions:-
 >>
 >> Do we expect messages larger than Max Spam Check Size to be accepted
 >> or dropped?
 >>
 >> Is there another parameter involved in addition to
 >>         Max Spam Check Size   = 200M
 >>         Max SpamAssassin Size = 200k
 >>
 >> I am running MailScanner version 4.72.5 and Spamassassin version
 >> 3.2.4
 >>
 >> Thanks,
 >> Paul
 >>
 >>
 >>
 >Maximum Message Size is the only one that I remember that would drop a
 >message.
 >
 >Can you post log snippets of the messages being dropped?


Sorry folks. I need to withdraw this one.

I had notice several "too big for spam check" messages with no
subsequent logged delivery. (I missed the logged instances of jobs with
this message that _were_ subsequently delivered.)

The problem messages were stuck in /var/spool/mqueue/ and had not been
processed as the load average was too high owing to unusually heavy
MailScanner processing. The MailScanner activity seemed to be related
to ~40 old jobs in /var/spool/mqueue.in/. Interestingly,those jobs had
been processed (the logs show viral content) but the entries had not
been removed from the queue. When I deleted these, normal behaviour
returned. (If I can pin this down a bit further I'll enter a new
thread.)

Paul