Raising max scan size

Strator

Verified User
Joined
Jan 19, 2011
Messages
239
Hi,

I'd like to raise the maximum size for mail scanned by spamassassin from the default 500kb to 1MB, but I just can't figure out how to get it done. Any pointers would be appreciated!

Basically, after trying various settings in local.cf I learned it's not even possible to change this via local.cf (is this true?) so I ended up editing exim.spamassassin.conf instead:

Code:
# Spam Assassin
spamcheck_director:
  driver = accept
  condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
  condition = "${if and { \
			{!eq {$received_protocol}{spam-scanned}} \
			{!eq {$received_protocol}{local}} \
			{exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
			{<{$message_size}{500k}} \
		} {1}{0}}"
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck
  no_verify
I replaced the 500k with 999k and restarted both spamassassin and exim, but no effect. What am I doing wrong?
 
Hello,

What exim.conf version do you use? Check the first 2-3 header lines for it.
 
Thanks for the reply - you must have telepathic abilities, because I was in the process of looking into upgrading exim.conf when your reply came in.

So it was 2.X - now is version 4.54.
 
This is just to confirm that, even with the newest exim.conf, the above configuration is still not having any effect.
 
OK, what error do you get?

What if you completely remove the line:

Code:
[COLOR=#333333]{<{$message_size}{500k}} \

temporary and restart exim? Does it solve the issue?[/COLOR]
 
I don't get an error - it's just that messages that are larger than 500k don't get scanned, even if I change that value (and restart exim/spamassassin).

Some sort of limit does make sense, but I will remove the line for testing purposes and see what happens. My prediction is that the 500k are probably hard-coded somewhere else.
 
Checked just now:

Code:
2017-04-18 01:37:54 1d0BX6-00061j-0V => pisma <[email protected]> F=<[email protected]> R=spamcheck_director T=spamcheck S=1206700
2017-04-18 01:37:54 1d0BX6-00061j-0V Completed

It's:

R=spamcheck_director
T=spamcheck
S=1206700

I have:

Code:
#1.2
# Spam Assassin
spamcheck_director:
  driver = accept
  condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
  condition = "${if and { \
                        {!eq {$received_protocol}{spam-scanned}} \
                        {!eq {$received_protocol}{local}} \
                        {exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
                        #{<{$message_size}{500k}} \
                } {1}{0}}"
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck
  no_verify

With exim.conf 4.5.4 default.
 
Thanks for checking back in. ;)

Turns out that my mainlog has similar entries like the one you posted above - but I'm not sure what "completed" means in the context, because the mail never ends up getting a spam header.
 
Ok, but when the processing has finished, shouldn't it add X-Spam headers? It does so for all of my messages, just not those over 500k.
 
OK, it seems there is a built-in limit in SpamAssassin set to 200K. I've got this:

Code:
X-Spam-Status: No, message_size=1207973 larger than 200K
after some debugging. So you can keep digging further and find out out how to fixit.

So, actually it might be considered as a minor bug, exim.conf should be in consequence with SpamAssassin's limits, I'd rather say.



And by the way:

Please note that SpamAssassin is not designed to scan large
messages. Don't feed messages larger than about 500 KB to
SpamAssassin, as this will consume a huge amount of memory.
 
OK, some more debugging. Though it drops the error:

Code:
X-Spam-Status: No, message_size=728748 larger than 200K

emails under 500K of size actually were checked with spamassassin:

Code:
#grep Spam 1492537350.M745856P32535.server.example.net,[B]S=439009[/B],W=444778
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on server.example.netX-Spam-Level:
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,

S=439009

Thus the error is confusing. Need to check spamassassin code and find where the limit is set.
 
It's a limit in easy_spam_fighter's variables.conf:

Code:
EASY_SPAMASSASSIN_MAX_SIZE = 200K

Found here: http://forum.directadmin.com/showthread.php?t=50059&p=263051#post263051

Code:
# grep Spam 1492543527.M762602P23504.[COLOR=#333333]server.example.net[/COLOR],[B]S=1219419[/B],W=1235379
DKIMCheck: Server passes DKIM test, -20 Spam score
X-Spam-Score: -0.1 (/)
X-Spam-Report: Spam detection software, running on the system "[COLOR=#333333]server.example.net[/COLOR]",
SpamTally: Final spam score: -20

S=1219419
 
Thank you, I will try the ESF configuration next.

For the record, the following did NOT work:

https://spamassassin.apache.org/full/3.2.x/doc/spamc.txt

The above command-line switches can also be loaded from a configuration file.

The format of the file is similar to the SpamAssassin rules files; blank lines and lines beginning with # are ignored. Any space-separated words are considered additions to the command line, and are prepended. Newlines are treated as equivalent to spaces. Existing command line switches will override any settings in the configuration file.

If the -F switch is specified, that file will be used. Otherwise, spamc will attempt to load spamc.conf in SYSCONFDIR (default: /etc/mail/spamassassin). If that file doesn't exist, and the -F switch is not specified, no configuration file will be read.

Example:

# spamc global configuration file

# connect to "server.example.com", port 783
-d server.example.com
-p 783
# max message size for scanning = 350k
-s 350000

EDIT: Ah, according to the thread you quoted, this was the old method I should have employed before updating. Your's is the new method. Crossing my fingers. ;)
 
Last edited:
Good. Please feel free to contact Directadmin directly via tickets for this: tickets.directadmin.com
 
As it turns out, this doesn't work either. Do you think it makes sense to actually submit this issue as a bug? I mean, what frustrates me so much about this is that it's really not so important to invest so much time - yet, it's also a matter of principle, being able to make decisions like this is actually one of the main reasons why I'm running my own mailserver. Arrrrgh.
 
Hello

X-Spam-Status: No, message_size=569926 larger than 200K

@zEitEr in the configuration of exim that the support mailing list from them do not know how to answer me, it changes or, because at the 200K, no scan of rspamd, is rather annoying, a lot of "false" message passes without difficulty.
 
Back
Top