Results 1 to 17 of 17

Thread: Raising max scan size

  1. #1
    Join Date
    Jan 2011
    Posts
    164

    Raising max scan size

    Hi,

    I'd like to raise the maximum size for mail scanned by spamassassin from the default 500kb to 1MB, but I just can't figure out how to get it done. Any pointers would be appreciated!

    Basically, after trying various settings in local.cf I learned it's not even possible to change this via local.cf (is this true?) so I ended up editing exim.spamassassin.conf instead:

    Code:
    # Spam Assassin
    spamcheck_director:
      driver = accept
      condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
      condition = "${if and { \
    			{!eq {$received_protocol}{spam-scanned}} \
    			{!eq {$received_protocol}{local}} \
    			{exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
    			{<{$message_size}{500k}} \
    		} {1}{0}}"
      retry_use_local_part
      headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
      transport = spamcheck
      no_verify
    I replaced the 500k with 999k and restarted both spamassassin and exim, but no effect. What am I doing wrong?

  2. #2
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    Hello,

    What exim.conf version do you use? Check the first 2-3 header lines for it.
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  3. #3
    Join Date
    Jan 2011
    Posts
    164
    Thanks for the reply - you must have telepathic abilities, because I was in the process of looking into upgrading exim.conf when your reply came in.

    So it was 2.X - now is version 4.54.

  4. #4
    Join Date
    Jan 2011
    Posts
    164
    This is just to confirm that, even with the newest exim.conf, the above configuration is still not having any effect.

  5. #5
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    OK, what error do you get?

    What if you completely remove the line:

    Code:
    {<{$message_size}{500k}} \


    temporary and restart exim? Does it solve the issue?
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  6. #6
    Join Date
    Jan 2011
    Posts
    164
    I don't get an error - it's just that messages that are larger than 500k don't get scanned, even if I change that value (and restart exim/spamassassin).

    Some sort of limit does make sense, but I will remove the line for testing purposes and see what happens. My prediction is that the 500k are probably hard-coded somewhere else.

  7. #7
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    Checked just now:

    Code:
    2017-04-18 01:37:54 1d0BX6-00061j-0V => pisma <pisma@example.net> F=<alexey@example.com> R=spamcheck_director T=spamcheck S=1206700
    2017-04-18 01:37:54 1d0BX6-00061j-0V Completed
    It's:

    R=spamcheck_director
    T=spamcheck
    S=1206700

    I have:

    Code:
    #1.2
    # Spam Assassin
    spamcheck_director:
      driver = accept
      condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
      condition = "${if and { \
                            {!eq {$received_protocol}{spam-scanned}} \
                            {!eq {$received_protocol}{local}} \
                            {exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
                            #{<{$message_size}{500k}} \
                    } {1}{0}}"
      retry_use_local_part
      headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
      transport = spamcheck
      no_verify
    With exim.conf 4.5.4 default.
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  8. #8
    Join Date
    Jan 2011
    Posts
    164
    Thanks for checking back in.

    Turns out that my mainlog has similar entries like the one you posted above - but I'm not sure what "completed" means in the context, because the mail never ends up getting a spam header.

  9. #9
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    A line of the form

    Code:
    2017-04-18 01:37:54 1d0BX6-00061j-0V Completed


    is written to the main log when a message is about to be removed from the spool at the end of its processing.

    http://www.exim.org/exim-html-curren....html#SECID257
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  10. #10
    Join Date
    Jan 2011
    Posts
    164
    Ok, but when the processing has finished, shouldn't it add X-Spam headers? It does so for all of my messages, just not those over 500k.

  11. #11
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    OK, it seems there is a built-in limit in SpamAssassin set to 200K. I've got this:

    Code:
    X-Spam-Status: No, message_size=1207973 larger than 200K
    after some debugging. So you can keep digging further and find out out how to fixit.

    So, actually it might be considered as a minor bug, exim.conf should be in consequence with SpamAssassin's limits, I'd rather say.



    And by the way:

    Please note that SpamAssassin is not designed to scan large
    messages. Don't feed messages larger than about 500 KB to
    SpamAssassin, as this will consume a huge amount of memory.
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  12. #12
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    OK, some more debugging. Though it drops the error:

    Code:
    X-Spam-Status: No, message_size=728748 larger than 200K
    emails under 500K of size actually were checked with spamassassin:

    Code:
    #grep Spam 1492537350.M745856P32535.server.example.net,S=439009,W=444778
    X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on server.example.netX-Spam-Level:
    X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
    S=439009

    Thus the error is confusing. Need to check spamassassin code and find where the limit is set.
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  13. #13
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    It's a limit in easy_spam_fighter's variables.conf:

    Code:
    EASY_SPAMASSASSIN_MAX_SIZE = 200K
    Found here: http://forum.directadmin.com/showthr...051#post263051

    Code:
    # grep Spam 1492543527.M762602P23504.server.example.net,S=1219419,W=1235379
    DKIMCheck: Server passes DKIM test, -20 Spam score
    X-Spam-Score: -0.1 (/)
    X-Spam-Report: Spam detection software, running on the system "server.example.net",
    SpamTally: Final spam score: -20
    S=1219419
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  14. #14
    Join Date
    Jan 2011
    Posts
    164
    Thank you, I will try the ESF configuration next.

    For the record, the following did NOT work:

    https://spamassassin.apache.org/full.../doc/spamc.txt

    The above command-line switches can also be loaded from a configuration file.

    The format of the file is similar to the SpamAssassin rules files; blank lines and lines beginning with # are ignored. Any space-separated words are considered additions to the command line, and are prepended. Newlines are treated as equivalent to spaces. Existing command line switches will override any settings in the configuration file.

    If the -F switch is specified, that file will be used. Otherwise, spamc will attempt to load spamc.conf in SYSCONFDIR (default: /etc/mail/spamassassin). If that file doesn't exist, and the -F switch is not specified, no configuration file will be read.

    Example:

    # spamc global configuration file

    # connect to "server.example.com", port 783
    -d server.example.com
    -p 783
    # max message size for scanning = 350k
    -s 350000
    EDIT: Ah, according to the thread you quoted, this was the old method I should have employed before updating. Your's is the new method. Crossing my fingers.
    Last edited by Strator; 04-24-2017 at 07:30 AM.

  15. #15
    Join Date
    Jan 2011
    Posts
    164
    Also, once the solution has been verified, this outdated info should be corrected: https://help.directadmin.com/item.php?id=156

  16. #16
    Join Date
    Apr 2005
    Location
    GMT +7.00
    Posts
    13,043
    Good. Please feel free to contact Directadmin directly via tickets for this: tickets.directadmin.com
    Regards, Alex G.

    - You can hire me on www.poralix.com to work on your server
    - Follow and like @Poralix on Facebook

  17. #17
    Join Date
    Jan 2011
    Posts
    164
    As it turns out, this doesn't work either. Do you think it makes sense to actually submit this issue as a bug? I mean, what frustrates me so much about this is that it's really not so important to invest so much time - yet, it's also a matter of principle, being able to make decisions like this is actually one of the main reasons why I'm running my own mailserver. Arrrrgh.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •