Spamassassin not scanning all messages

Troy McClure · **Joined:** Tue May 10, 2005 1:24 pm **Posts:** 193

I have been having a problem with spamassassin not scanning all messages that come through. I get this in the logs.

Code:

Mar 30 10:12:58 hostname qmail-scanner[31196]: Clear:RC:0(sending_ip_address):SA:0(?/?): 0.472982 542252 user1@domain1.com user2@domain2.com RE:_I_miss_you_already! <DF3C805720266143930C1A5E611ACA24015A838E@mailserver1.com> 1238422378.31208-1.mailserver2.com:11976 image002.jpg:276116 orig-mailserver2.com123842237779231196:542252 image001.jpg:110477 1238422378.31208-0.mailserver2.com:5515

Is there anyway to track down what is causing this? I have asl installed and everything is up to date. One thing I have noticed is that there always seems to be an attachment on these though not all messages with attachments get this. What would be the best way to determine what is going on here?

Kalimari · **Posted:** Mon Mar 30, 2009 12:48 pm

Do those messages have attachments? There is a file size limit in qmail-scanner/spamassassin which set the max size for message scanning - and that's what I see when message go over - can't remember the exact file/settings to adjust, but generally spam falls under this threshold so it's not a problem.

Troy McClure · **Joined:** Tue May 10, 2005 1:24 pm **Posts:** 193

Yes, these do have attachments. The problem is that some of these are spam messages and the attachments aren't too big. I will find one of the messages and see how big the attachment is and report back.

Troy McClure · **Joined:** Tue May 10, 2005 1:24 pm **Posts:** 193

OK, I just looked at one and it didn't have any attachments. It was an email with different mime types. The html wanted pictures downloaded and then the txt part just had some spam text in it. Is there anyway to tell what rule caused spamassassin to not scan?

Troy McClure · **Joined:** Tue May 10, 2005 1:24 pm **Posts:** 193

I have figured out that it is the message size that is causing this. All messages that come in like this are above 250k (the default I think). Does anyone know how to raise that limit? I am getting quite a few spam messages that are between 250k and 300k.

Kalimari · **Posted:** Tue Mar 31, 2009 2:34 pm

There is a max scan size option in either qmail-scanner or spamassassin (possibly in /etc/qmail-scanner.ini) sorry can't remember exactly and I'm away from office PC/notes at the moment - I'll check tomorrow.

RichardM · **Joined:** Sun Apr 20, 2008 2:51 pm **Posts:** 69

Troy - did you get this figured out? I'm having the same problem! A particular class of HTML emails with "Content-Type: image/jpeg" parts are getting past SA without SA doing any checking (the SA headers are missing from the email).

I'm on Plesk 8.6 (Qmail).

Troy McClure · **Joined:** Tue May 10, 2005 1:24 pm **Posts:** 193

No, I never figured this out. The issue wasn't really too big of a problem for me and I just got too busy to look into it anymore. I think I did see the setting Kalimari is talking about, but can't really remember where.

Spamassassin not scanning all messages

Who is online