Re: Message Size Limit

Myles Williams wrote:
 > I'm using spamassassin 2.63-1. I'm finding every message is being sent
 > through to spamd even if it's over the 250k default. I don't have a
 > different default set anywhere, and it's causing my system to jerk
 > when large attachments come flying through the door.

Miles, firstly you might want to update your exim and exiscan versions. 
Notably there's a "defer_ok" flag for SpamAssassin after version 18 that 
can allow an ACL to defer a message if SA is unavailable.

Secondly, you might want to reduce your size limit. You'll probably find 
you machine takes time processing messages larger than 50K, let alone 
250K. I think a lot of people settle for 80K. The economics of spamming 
suggest that we won't see spam messages of this size

Thirdly, if you want to apply a size check against messages checked for 
spam, the check has to be carried out in every ACL that uses the spam 
condition.

The following two ACLs will result in *EVERY* message getting passed 
through SpamAssassin, because there is no condition on the 2nd ACL here.

warn message    = X-New-Subject: [SPAM] $h_subject:
  condition      = ${if <{$message_size}{80k}{1}{0}}
  spam           = nobody
  log_message    = [SPAM] $spam_score

  warn message   = X-Spam-Score: $spam_score ($spam_bar)
   spam          = nobody:true


You can either add the condition to every ACL with spam condition, or 
you use branching ACLs. Like the the example below. If you're going to 
use branching ACLs, make *sure* you test it throughly before you use it 
live. The logic doesn't always work out the way you might expect.

--- In the DATA ACL:
# Check for spam if it wasn't from "us".
deny    hosts           = !+relay_from_hosts
         condition       = ${if and { \
                                 { < {$message_size}{80k} } \
                                 {! def:h_X-Spam-Flag:} \
                                         } {1}{0}}
         !acl            = acl_check_data_spam
---

--- Separate Spam ACL.
acl_check_data_spam:
# Defer message if problem with SpamAssassin.
deny    spam            = exim:true
         condition       = false

# Always add the score header
warn    message         = X-Spam-Score: $spam_score
         spam            = exim:true

# Log the score for non-spam messages
warn    log_message     = Score: $spam_score
         spam            = exim:true
         condition       = ${if <{$spam_score_int}{50}{1}{0}}

# Always add the Report header
warn    message         = X-Spam-Report: $spam_report
         spam            = exim:true

# Always add the Level header for positive spam scores.
warn    message         = X-Spam-Level: ${tr{$spam_bar}{+}{*}}
         spam            = exim:true
         condition       = ${if >{$spam_score_int}{0}{1}{0}}

# Log the score for spam messages.
warn    log_message     = Score: $spam_score - Marked as Spam
         spam            = exim

# Add the spam header for spam messages.
warn    message         = X-Spam-Flag: YES
         spam            = exim

accept
---


Finally, in the example I've given, I've included the $spam_report. To 
have this be the "terse" report you need the following in your SA local.cf:

--- in SA local.cf
clear_report_template
report Status _YESNO_, hits=_HITS_ required=_REQD_ version=_VERSION_
report _REPORT_
---

I hope this helps,

Cheers,
Matt.