Bogged down by huge email

[Ben Wylie <sa...@benwylie.co.uk>]

First of all, do rawbody emails literally scan the raw email including 
massive attachments?
I received an email today with a 7MB MS Word attachment. This email 
completely bogged down the system, as if there were rules scanning the 
raw attachment (which wouldn't be very fruitful and takes ages!).

If these rawbody rules are scanning all attachments, is there a way to 
get them to only scan html and text mime parts?

Also is there an option in Spamassassin which you can set to prevent it 
from scanning emails over a certain size (eg 1mb).

Thanks
Ben

Re: Bogged down by huge email

[Will Nordmeyer <wi...@willspc.net>]

On Thu, 22 Feb 2007 16:28:26 +0000, Ben Wylie wrote
> First of all, do rawbody emails literally scan the raw email 
> including massive attachments? I received an email today with a 7MB 
> MS Word attachment. This email completely bogged down the system, as 
> if there were rules scanning the raw attachment (which wouldn't be 
> very fruitful and takes ages!).
> 
> If these rawbody rules are scanning all attachments, is there a way 
> to get them to only scan html and text mime parts?
> 
> Also is there an option in Spamassassin which you can set to prevent 
> it from scanning emails over a certain size (eg 1mb).
> 
> Thanks
> Ben

I have spamassassin run via a systemwide procmailrc file.  It only scans 
files < 256,000 bytes.  I also bypass the SA filter for spamassassin's 
mailing list (which relieves quite a bit of load from the system since SA's 
list is very busy).

Here's what I've got:

#DROPPRIVS=yes

SHELL=/bin/sh
#LOGFILE=$HOME/.procmail-log
#VERBOSE=on
DROPPRIVS=yes

:0:
*^List-ID: <users.spamassassin.apache.org>
     /var/spool/mail/$LOGNAME

:0fw
* < 256000
| spamc -U /tmp/spamd.sock

Re: Bogged down by huge email

[Theo Van Dinter <fe...@apache.org>]

On Thu, Feb 22, 2007 at 04:28:26PM +0000, Ben Wylie wrote:
> First of all, do rawbody emails literally scan the raw email including 
> massive attachments?

What are rawbody emails?  Do you mean rawbody rules?  They only look at
text and message parts.  Full rules run on the whole message.

> I received an email today with a 7MB MS Word attachment. This email 
> completely bogged down the system, as if there were rules scanning the 
> raw attachment (which wouldn't be very fruitful and takes ages!).

The maximum recommended mail size to pass to SA is 256k.  Also, scanning the
attachment may be useful depending on what's going on.

> If these rawbody rules are scanning all attachments, is there a way to 
> get them to only scan html and text mime parts?

That's essentially how they work already.

> Also is there an option in Spamassassin which you can set to prevent it 
> from scanning emails over a certain size (eg 1mb).

spamc has a limitation (250k) over which it acts as a pass-through.
"spamassassin" and "spamd" in general have no such limitation -- it
expects you to only send in things that you want scanned.

-- 
Randomly Selected Tagline:
If you are a police dog, where's your badge?
 		-- Question James Thurber used to drive his German Shepherd
 		   crazy.