Re: Scanning large-body spam

2010-03-31 Thread Mark Martinec
On Wednesday March 31 2010 23:43:25 Charles Gregory wrote: > Is there really a problem with the in-memory size? I would have thought > the major concern was the processing time for evaluating 'full' (and > rawbody?) rules on a large message Yes, sure, the main issue is with evaluating regexp r

Re: Scanning large-body spam

2010-03-31 Thread Charles Gregory
On Wed, 31 Mar 2010, Mark Martinec wrote: and let it handle arbitrary size messages by avoiding its current paradigm of keeping the entire message in memory. Is there really a problem with the in-memory size? I would have thought the major concern was the processing time for evaluating 'f

Re: Scanning large-body spam

2010-03-31 Thread Mark Martinec
On Wednesday March 31 2010 18:05:52 Charles Gregory wrote: > Excuse me for not *thinking* earlier, but it occurs to me that there is a > very big drawback to *truncating* a message before passing it to SA, as > opposed to my original request/suggestion to *flag* (or set a config > param?) to tell S

Re: Scanning large-body spam

2010-03-31 Thread Alex
Hi, >> Does anyone have any suggestions for optimizing the process for spam >> containing just a large image that would therefore bypass the typical >> scanning? Should I be scanning messages that large, then? > > Depends on your available CPU resources.  If you always have a low > load average, y

Re: Scanning large-body spam

2010-03-31 Thread Charles Gregory
On Wed, 31 Mar 2010, Henrik K wrote: SA 3.3 has special handling for truncated messages Excuse me for not *thinking* earlier, but it occurs to me that there is a very big drawback to *truncating* a message before passing it to SA, as opposed to my original request/suggestion to *flag* (or

Re: Scanning large-body spam

2010-03-31 Thread Henrik K
On Wed, Mar 31, 2010 at 11:05:57AM -0400, Adam Katz wrote: > > Wasn't some earlier version of SA capable of scanning just the /first/ > [size] of an email? Probably harder to implement within MIME, but > some control to internally truncate remaining pieces (for scanning > only, like the pseudo-he

Re: Scanning large-body spam

2010-03-31 Thread Adam Katz
Alex wrote: > What settings do people typically have these days for the maximum > scanned message size? Surprisingly, at least to me, I'm seeing spam in > the 650k and 700k range, at least a few per hour, and are not scanned. > > Does anyone have any suggestions for optimizing the process for spam

Re: Scanning large-body spam

2010-03-30 Thread Lee Dilkie
Alex wrote: > Hi, > > What settings do people typically have these days for the maximum > scanned message size? Surprisingly, at least to me, I'm seeing spam in > the 650k and 700k range, at least a few per hour, and are not scanned. > > Does anyone have any suggestions for optimizing the process f