SA Skipped Message

[Carlos Mennens <ca...@gmail.com>]

I noticed someone sent me an email and there are no SA heading info in
the message. SA didn't provide a score or status on the message
headers for some weird reason. I then checked my mail logs and saw
this message:

Mar  5 08:52:18 mail spamc[2635]: skipped message, greater than max
message size (512000 bytes)

What does this mean? Should I change configuration settings to make
sure this doesn't happen? Any advice on what to do is greatly
appreciated.

-Carlos

Re: SA Skipped Message

[Bowie Bailey <Bo...@BUC.com>]

Carlos Mennens wrote:
> I noticed someone sent me an email and there are no SA heading info in
> the message. SA didn't provide a score or status on the message
> headers for some weird reason. I then checked my mail logs and saw
> this message:
>
> Mar  5 08:52:18 mail spamc[2635]: skipped message, greater than max
> message size (512000 bytes)
>
> What does this mean? Should I change configuration settings to make
> sure this doesn't happen? Any advice on what to do is greatly
> appreciated.
>   

This means that spamc did not send the message to SpamAssassin because
it was larger than the default size limit of 500K.  This limit is to
prevent SA from wasting lots of time scanning large messages.  Most spam
messages are fairly small.

If you want to raise this limit, use the '-s' option when you call
spamc.  For example:

    spamc -s 1024000

This will raise the limit to 1000K.  However, you probably don't want to
raise this limit unless you start seeing a significant number of spam
come through that is larger than the limit.  And don't raise it too high
-- there is no point in having SA try to scan a 5MB email full of family
pictures.

-- 
Bowie

Re: SA Skipped Message

[Carlos Mennens <ca...@gmail.com>]

2010/3/5 Karsten Bräckelmann <gu...@rudersport.de>:
> Nope, don't change it. It's a default for a reason. :)
>
> Setting this limit higher usually will not even catch more spam, since
> almost no spam exceeds that size. Typically, they are *much* smaller.
> However, ham with large attachments would then also be processed.

That sounds good and thanks for the info!

Re: SA Skipped Message

[Karsten Bräckelmann <gu...@rudersport.de>]

On Fri, 2010-03-05 at 10:42 -0500, Carlos Mennens wrote:
> I noticed someone sent me an email and there are no SA heading info in
> the message. SA didn't provide a score or status on the message
> headers for some weird reason. I then checked my mail logs and saw
> this message:
> 
> Mar  5 08:52:18 mail spamc[2635]: skipped message, greater than max
> message size (512000 bytes)

spamc has a max message size limit option, and won't pass messages
larger than that to spamd. This is partly to prevent attacks, and
generally to prevent burning too many CPU cycles on a single message.

This is entirely normal. See man spamc for details.

> What does this mean? Should I change configuration settings to make
> sure this doesn't happen? Any advice on what to do is greatly
> appreciated.

Nope, don't change it. It's a default for a reason. :)

Setting this limit higher usually will not even catch more spam, since
almost no spam exceeds that size. Typically, they are *much* smaller.
However, ham with large attachments would then also be processed.

Unless you get a significant amount of really large spam, *and* have a
beefy machine, don't fiddle with that option.

  guenther


-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}