email is too big for spam checks

[Glenn Steen]

2009/6/30 Eduardo Casarero <ecasarero at gmail.com>:
>
>
> 2009/6/30 Mauricio Tavares <raubvogel at gmail.com>
>>
>>      I have setup mailscanner such that it only does spam checking,
>> not virus checking. Recently I saw on the logs a message saying it is
>> too big for spam checks. I have my Max Spam Check Size currently set
>> to 150000. Since there are spam messages with attached images and so
>> on, what would be a good size for that? I am asked to make it
>> unlimited somehow, but I do not know if I should. After all, as it is
>> said in the MailScanner.conf file, a large email is probably not spam.
>>
>> Also, is the 150000 measure in what units? Bytes?
>
> yes is in bytes, the size depends on your traffic i've 500000 in some
> servers and in others 800000, however i've seen spam emails with a size of 1
> Mb. Remember bigger emails checks will increase your CPU/MEM/IO use.
>
Quite true. Making this limit "unlimited would mean setting it equal
or larger than the maximum message size your MTA enforces (and that
one is more or less mandated to have a finite limit).
It can actually be quite OK to set this one really large, from a
MailScanner/SpamAssassin perspective, since you also have limits on
how much of the message to pass on to SpamAssassin (from MailScanner).
The Max SpamAssassin Size setting is ... wonderful... in that it can
do some silly hoops to do the right thing for large images etc. Be
sure to read the comment above it carefully!
My settings for these (on a somewhat muscular box... Nothing fancy,
just not ol' scrap:-) is a lot higher than the defaults... MTA max
message size/2 == Max Spam Check Size (empirical study of where to set
that one... Higher doesn't benefit my mailflow), and Max Spam Check
Size/2 ~= Max SpamAssassin Size ... we're talking MiBs, not KiBs.
But then my mailflow is meager (~10k/day), so ... you'll have to do
some calculations on your own, to see what fits yours best. MailWatch
can be a real useful tool to determine average sizes etc.

Not doing at least Clamd in MailScanner seem ... wasteful ... The
"expensive" part of the scanning is the spam detection, not the AV
part... And clam is "right-prized";-).

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se