Help mp3 attachment

[John Fleming <jo...@wa9als.com>]

I run a very simple Postfix - Procmail - SpamAssassin - CLamAV setup that 
has been working great, but tonight I see something I don't understand. 
Look at the 2 examples below please.  Both messages got virus-scanned. 
However, the message that includes an mp3 audio attachment, appears that it 
didn't get spam-scanned at all, whereas a totally plain message does.  Can 
anyone explain this?  What attachment property would cause the message not 
to pass to spamd at all?  Thanks - John

Plain message with 500K mp3 attachment:

X-Virus-Status: No
X-Virus-Checker-Version: Luke wa9als.com running clamassassin 1.2.1 with 
ClamAV 0.85/879/Sun May 15 08:43:45 2005 signatures 31.879
Status:
X-Antivirus: AVG for E-mail 7.0.308 [266.11.10]
Mime-Version: 1.0
Content-Type: multipart/mixed; 
boundary="----=_NextPart_000_0050_01C5599C.1DDB9FF0"



Plain message without attachment:

X-Virus-Status: No
X-Virus-Checker-Version: Luke wa9als.com running clamassassin 1.2.1 with 
ClamAV 0.85/879/Sun May 15 08:43:45 2005 signatures 31.879
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on Luke.wa9als.com
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham
 version=3.0.2
Status:
X-Antivirus: AVG for E-mail 7.0.308 [266.11.10]
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; format=flowed; charset=iso-8859-1; 
reply-type=original



-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.11.10 - Release Date: 5/13/2005

Re: Help mp3 attachment

[John Fleming <jo...@wa9als.com>]

> On Sun, 2005-05-15 at 22:34 -0500, John Fleming wrote:
>> I run a very simple Postfix - Procmail - SpamAssassin - CLamAV setup that
>> has been working great, but tonight I see something I don't understand.
>
> I suspect that your procmail recipe doesn't scan files over a certain
> size.  What does your .procmailrc file look like?

Thanks THomas and Wolfgang - That's probably part of it.  The procmail is 
simple:

:0fw
| /usr/bin/spamc
#
:0:
* ^X-Spam-Flag: Yes
/dev/null

But I didn't mention 2 other important points:

1.  The mail with the large attachment DOES NOT GET DELIVERED - So it must 
be getting tagged as spam and then going to /dev/null, I suppose.  I can 
change /dev/null to my spam trap that I use for other users and see if it 
goes there.

2.  But the REAL problem is more obtuse and scary - After the email with the 
large attachment goes through, then spamd no longer scans ANY mail until I 
restart it!

Thanks any further thoughts.  - John



-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.308 / Virus Database: 266.11.10 - Release Date: 5/13/2005

Re: Help mp3 attachment

[Thomas Cameron <th...@camerontech.com>]

On Sun, 2005-05-15 at 22:34 -0500, John Fleming wrote:
> I run a very simple Postfix - Procmail - SpamAssassin - CLamAV setup that 
> has been working great, but tonight I see something I don't understand. 

I suspect that your procmail recipe doesn't scan files over a certain
size.  What does your .procmailrc file look like?

Thomas