qmail-scanner message size problem

Forum for getting help with Project Gamera, Spamassassin, Clamav, qmail-scanner and other anti-spam tools.
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

qmail-scanner message size problem

Unread post by faris »

Christoph and I have discovered what seems to be an annoying issue with qmail-scanner

He noticed that some messages, including spam, were not being scanned by Spamassassin and were generating a log entry like this:

Code: Select all

qmail-scanner-queue.pl: qmail-scanner[2663]: Clear:RC:0(sending-ip-address):SA:0(?/?): (message details....)
Note the "?/?" from SA

After going round in circles and looking at logs and going absolutely nuts, I discovered that the messages in question all had attachments or inline images. Not huge ones though. Just typical attachments - a pdf here, a jpeg there.

For example, one message was just 2.3Mb in size including some inline images.

Looking at the qmail-scanner-queue.pl, I noticed two things:
1) At the top, in the configure detail line, it shows: --sa-maxsize 1024000 --- This is 1Mb.
2) In the bowels of the file, the following code can be found:

Code: Select all

# st: I have returned to my own way to set the  (1.25st)
my $spamc_binary='/usr/bin/spamc';
my $sa_timeout='120';
my $sa_maxsize='1024000';

[snip snip]

$spamc_binary.=" -t $sa_timeout" if ($sa_timeout ne "");
$spamc_binary.=" -s $sa_maxsize" if ($sa_maxsize ne "");
Again this is 1Mb.
-s max_size
Set the maximum message size which will be sent to spamd -- any bigger than this threshold and the message will be returned unprocessed (default: 250 KB). If spamc gets handed a message bigger than this, it won't be passed to spamd.
The size is specified in bytes, as a positive integer greater than 0. For example, -s 250000.

Editing my $sa_maxsize='1024000'; to add another 0 in the live qmail-scannerqueue.pl instantly caused the messages that were not being scanned to be scanned.

So......

from looking at /usr/share/qmail-scanner/qmail-scanner-queue.template, it looked like you could change the value of this through the configuration file. So I added
SA_MAXSIZE="10240000" (i.e. an extra 0) to qmail-scanner.ini, did a qmail-scanner-reconfigure and


errr...EDIT!...I thought it worked! But it doesn't!

Does anybody have any suggestions about how to get this to stick through a reinstall or a reconfigure?
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
prupert
Forum Regular
Forum Regular
Posts: 573
Joined: Tue Aug 01, 2006 2:45 pm
Location: Netherlands

Re: qmail-scanner message size problem

Unread post by prupert »

Spam is rarely that large and it will take full message rules in SpamAssassin exponentially more resources scanning it. I would never raise this limit to anything more than 1 MB.
Lemonbit Internet Dedicated Server Management
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: qmail-scanner message size problem

Unread post by faris »

That's sensible advice, but nevertheless we're seeing unwanted messages on this system (from Africa) that are larger than 2Megs.

I don't know how frequently they get sent. We'll keep an eye on it.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
AntiochInteractive
Forum User
Forum User
Posts: 35
Joined: Thu Jan 08, 2009 4:31 am
Location: Fort Worth, TX
Contact:

Re: qmail-scanner message size problem

Unread post by AntiochInteractive »

Hey Guys -

I took a look through my maillogs, and this happens on my servers too.

[root@server ~]# cat /var/log/mail* | grep -i '(?/?)' > /root/mailparsed

100% of the e-mails that this happens on are legitimate e-mails created by clients -- none were spam.

I second prupert's logic.
Post Reply