Raising max scan size

S

Strator

Verified User
Joined
Jan 19, 2011
Messages
290
Hi,

I'd like to raise the maximum size for mail scanned by spamassassin from the default 500kb to 1MB, but I just can't figure out how to get it done. Any pointers would be appreciated!

Basically, after trying various settings in local.cf I learned it's not even possible to change this via local.cf (is this true?) so I ended up editing exim.spamassassin.conf instead:

Code: 
# Spam Assassin
spamcheck_director:
  driver = accept
  condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
  condition = "${if and { \
			{!eq {$received_protocol}{spam-scanned}} \
			{!eq {$received_protocol}{local}} \
			{exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
			{<{$message_size}{500k}} \
		} {1}{0}}"
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck
  no_verify
I replaced the 500k with 999k and restarted both spamassassin and exim, but no effect. What am I doing wrong?
 
Thanks for the reply - you must have telepathic abilities, because I was in the process of looking into upgrading exim.conf when your reply came in.

So it was 2.X - now is version 4.54.
 
This is just to confirm that, even with the newest exim.conf, the above configuration is still not having any effect.
 
OK, what error do you get?

What if you completely remove the line:

Code: 
[COLOR=#333333]{<{$message_size}{500k}} \

temporary and restart exim? Does it solve the issue?[/COLOR]
 
I don't get an error - it's just that messages that are larger than 500k don't get scanned, even if I change that value (and restart exim/spamassassin).

Some sort of limit does make sense, but I will remove the line for testing purposes and see what happens. My prediction is that the 500k are probably hard-coded somewhere else.
 
Checked just now:

Code: 
2017-04-18 01:37:54 1d0BX6-00061j-0V => pisma <[email protected]> F=<[email protected]> R=spamcheck_director T=spamcheck S=1206700
2017-04-18 01:37:54 1d0BX6-00061j-0V Completed

It's:

R=spamcheck_director
T=spamcheck
S=1206700

I have:

Code: 
#1.2
# Spam Assassin
spamcheck_director:
  driver = accept
  condition = ${if !eq{$acl_m_spam_assassin_has_run}{1}}
  condition = "${if and { \
                        {!eq {$received_protocol}{spam-scanned}} \
                        {!eq {$received_protocol}{local}} \
                        {exists{/home/${lookup{$domain}lsearch{/etc/virtual/domainowners}{$value}}/.spamassassin/user_prefs}} \
                        #{<{$message_size}{500k}} \
                } {1}{0}}"
  retry_use_local_part
  headers_remove = X-Spam-Flag:X-Spam-Report:X-Spam-Status:X-Spam-Level:X-Spam-Checker-Version
  transport = spamcheck
  no_verify

With exim.conf 4.5.4 default.
 
Thanks for checking back in. ;)

Turns out that my mainlog has similar entries like the one you posted above - but I'm not sure what "completed" means in the context, because the mail never ends up getting a spam header.
 
Ok, but when the processing has finished, shouldn't it add X-Spam headers? It does so for all of my messages, just not those over 500k.
 
OK, it seems there is a built-in limit in SpamAssassin set to 200K. I've got this:

Code: 
X-Spam-Status: No, message_size=1207973 larger than 200K
after some debugging. So you can keep digging further and find out out how to fixit.

So, actually it might be considered as a minor bug, exim.conf should be in consequence with SpamAssassin's limits, I'd rather say.



And by the way:

Please note that SpamAssassin is not designed to scan large
messages. Don't feed messages larger than about 500 KB to
SpamAssassin, as this will consume a huge amount of memory.
Click to expand...
 
OK, some more debugging. Though it drops the error:

Code: 
X-Spam-Status: No, message_size=728748 larger than 200K

emails under 500K of size actually were checked with spamassassin:

Code: 
#grep Spam 1492537350.M745856P32535.server.example.net,[B]S=439009[/B],W=444778
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on server.example.netX-Spam-Level:
X-Spam-Status: No, score=0.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,

S=439009

Thus the error is confusing. Need to check spamassassin code and find where the limit is set.
 
It's a limit in easy_spam_fighter's variables.conf:

Code: 
EASY_SPAMASSASSIN_MAX_SIZE = 200K

Found here: http://forum.directadmin.com/showthread.php?t=50059&p=263051#post263051

Code: 
# grep Spam 1492543527.M762602P23504.[COLOR=#333333]server.example.net[/COLOR],[B]S=1219419[/B],W=1235379
DKIMCheck: Server passes DKIM test, -20 Spam score
X-Spam-Score: -0.1 (/)
X-Spam-Report: Spam detection software, running on the system "[COLOR=#333333]server.example.net[/COLOR]",
SpamTally: Final spam score: -20

S=1219419
 
Thank you, I will try the ESF configuration next.

For the record, the following did NOT work:

https://spamassassin.apache.org/full/3.2.x/doc/spamc.txt

The above command-line switches can also be loaded from a configuration file.

The format of the file is similar to the SpamAssassin rules files; blank lines and lines beginning with # are ignored. Any space-separated words are considered additions to the command line, and are prepended. Newlines are treated as equivalent to spaces. Existing command line switches will override any settings in the configuration file.

If the -F switch is specified, that file will be used. Otherwise, spamc will attempt to load spamc.conf in SYSCONFDIR (default: /etc/mail/spamassassin). If that file doesn't exist, and the -F switch is not specified, no configuration file will be read.

Example:

# spamc global configuration file

# connect to "server.example.com", port 783
-d server.example.com
-p 783
# max message size for scanning = 350k
-s 350000
Click to expand...

EDIT: Ah, according to the thread you quoted, this was the old method I should have employed before updating. Your's is the new method. Crossing my fingers. ;)
 
Last edited:
As it turns out, this doesn't work either. Do you think it makes sense to actually submit this issue as a bug? I mean, what frustrates me so much about this is that it's really not so important to invest so much time - yet, it's also a matter of principle, being able to make decisions like this is actually one of the main reasons why I'm running my own mailserver. Arrrrgh.
 
Hello

X-Spam-Status: No, message_size=569926 larger than 200K
Click to expand...

@zEitEr in the configuration of exim that the support mailing list from them do not know how to answer me, it changes or, because at the 200K, no scan of rspamd, is rather annoying, a lot of "false" message passes without difficulty.
 
For the record, for SA we do recommend that you allow scanning of larger messages than the default, we recommend 4MG, but you should restrict the scanning sizes for each part.

This will help reduce overhead..

body_part_scan_size 200000
rawbody_part_scan_size 200000
 
You must log in or register to reply here.
Back
Top