"too big for spam checks"

[Steve Campbell]

Quoting Paul Lamb <pal at mssl.ucl.ac.uk>:

>  >Date: Wed, 25 Feb 2009 12:01:52 -0800
>  >From: Scott Silva <ssilva at sgvwater.com>
>  >
>  >on 2-25-2009 11:14 AM Paul Lamb spake the following:
>  >>
>  >> I have noticed a number of MailScanner messages in /var/log/messages
>  >> of the form:-
>  >>
>  >> MailScanner: Message <number> from ... is too big for spam check
>  >>
>  >> Such messages are dropped which I find surprising as the comments in
>  >> MailScanner.conf against Max Spam Check Size include:-
>  >>         # ...if a message is bigger than a certain size, it
>  >>         # is highly unlikely to be spam. Limiting this saves
>  >>         # a lot of time checking huge messages.
>  >>
>  >> This suggests to me that larger messages should be accepted. I
>  >> believe that this was the case with the last versions of
>  >> MailScanner/Spamassassin that I used).
>  >>
>  >> The few messages to the list about this error message do not
>  >> explicitly answer these two questions:-
>  >>
>  >> Do we expect messages larger than Max Spam Check Size to be accepted
>  >> or dropped?
>  >>
>  >> Is there another parameter involved in addition to
>  >>         Max Spam Check Size   = 200M
>  >>         Max SpamAssassin Size = 200k
>  >>
>  >> I am running MailScanner version 4.72.5 and Spamassassin version
>  >> 3.2.4
>  >>
>  >> Thanks,
>  >> Paul
>  >>
>  >>
>  >>
>  >Maximum Message Size is the only one that I remember that would drop a
>  >message.
>  >
>  >Can you post log snippets of the messages being dropped?
> 
> 
> Sorry folks. I need to withdraw this one.
> 
> I had notice several "too big for spam check" messages with no
> subsequent logged delivery. (I missed the logged instances of jobs with
> this message that _were_ subsequently delivered.)
> 
> The problem messages were stuck in /var/spool/mqueue/ and had not been
> processed as the load average was too high owing to unusually heavy
> MailScanner processing. The MailScanner activity seemed to be related
> to ~40 old jobs in /var/spool/mqueue.in/. Interestingly,those jobs had
> been processed (the logs show viral content) but the entries had not
> been removed from the queue. When I deleted these, normal behaviour
> returned. (If I can pin this down a bit further I'll enter a new
> thread.)
> 
> Paul
> 
> 
>

Paul,

I saw this also, and I believe it was with an older version. I could never
provide any evidence of what was going on, though. It happened just yesterday or
maybe the day before, and although the message wasn't deleted, it was severely
delayed. So I'm still not sure what was going on.

The earlier instances were difficult to investigate due to the amount of time
after posting that I was notified.

I'm not sure there is a real problem, but there might be some shakiness
somewhere. Not even sure it's MS as the load may have been a problem here also.

Anyway, it happened multiple times, particularly one user who gets emailed large
ads, and they never showed up.

Steve Campbell 

-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/