spamc: skipped message, greater than max message size

[caribk]

i'm having a problem with spamc skipping orcessing of messages with larger than 256K attachment, and then sendmail subsequently silently discards the message.

i got the following error in the maillog:

spamc[xxx]: skipped message, greater than max message size[/quote] (256000 bytes)

intuitively, for efficiency concerns spamassassin should probably not process larger messages but i still want delivery to complete.

i'm using Scalix 10.0 on RHES3

any ideas?

[btisdall]

Skipping the scan shouldn't cause sendmail to discard the message - can you post the relevant portion of your mail log when such a mail is processed.

[caribk]

here's a portion of the maillog (with domains changed):

Code: Select all

Aug 18 16:45:24 samba sendmail[2219]: k7IKjOjK002219: from=<xxxx@somewhere.com>, size=366722, class=0, nrcpts=2, msgid=<H0
000067000e7ff1.1155933923.samba.domain.com@MHS>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
Aug 18 16:45:24 samba spamc[2225]: skipped message, greater than max message size (256000 bytes)
Aug 18 16:45:25 samba spamass-milter[18732]: Could not extract score from <>
Aug 18 16:45:25 samba sendmail[2219]: k7IKjOjK002219: Milter add: header: X-Virus-Scanned: ClamAV 0.88.2/1686/Fri Aug 18 16:43:48
2006 on samba.domain.com
Aug 18 16:45:25 samba sendmail[2219]: k7IKjOjK002219: Milter add: header: X-Virus-Status: Clean
Aug 18 16:45:25 samba sendmail[2217]: k7IKjO1I002217: to=<xxxxx@nortel.com>,<xxx@msn.com>, delay=00:00:01, xdelay=00:00
:01, mailer=relay, pri=426551, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (k7IKjOjK002219 Message accepted for delivery)
Aug 18 16:45:25 samba sendmail[2227]: STARTTLS=client, relay=mail.domain.com., version=TLSv1/SSLv3, verify=FAIL, cipher=DHE-RSA-
AES256-SHA, bits=256/256
Aug 18 16:45:31 samba sendmail[2106]: k7IKjVBd002106: tcpwrappers (unknown, 200.217.122.173) rejection


the messages end up in the error queue, which i can see using the command omstat -q error

an attempt to resubmit the messages for delivery using omresub -q error neither results in successful delivery or any new information in the maillog..

any ideas?

[ScalixSupport]

intuitively, for efficiency concerns spamassassin should probably not process larger messages but i still want delivery to complete.

I don't understand. If the rule is not to deliver messages over 256k how can you expect the message to get delivered?

Thanks,
Don

[btisdall]

I don't understand. If the rule is not to deliver messages over 256k how can you expect the message to get delivered?

Crossed wires here I think - the OP was referring to SA's default behaviour of skipping tests on mail larger than a certain size, typically 64 or 256k, for performance reasons.

In this case I wonder if SA is the culprit as one can see clamav-milter handing the same message off to ClamAV before the end of the log fragment.

[caribk]

as ben mentions that is what i meant.. from my understanding SA tests are skipped for larger that 256K messages, but not the sm delivery..

and.. from further testing this behavior.. it does not seem like every message over 256K gets moved to the error queue due to this behavior. i have gotten 400-500K attachments to come through without generating this error. it seems like that is the default error message, but the 256K is not necessarily the limit..?

any additional information needed can be provided.. these messages are still on my error queue and i can't get them delivered using the omresub method.

[btisdall]

It seems odd that so serious a problem isn't being logged - if you still have the log from which you posted the fragment can you do:

Code: Select all

grep k7IKjOjK002219 /var/log/<logname>

[caribk]

been doing some further testing and the reason that don was confused might be that it seems like the spamc test being skipped in *not* the reason why delivery failed and messages like the one below gets placed in the error queue..

i've included some more information about a message from the following entry in the maillog:

Code: Select all

Aug 18 14:46:30 mail sendmail[29721]: k7IIkN6o029721: from=<user@somewhere.com>, size=2164607, class=0, nrcpts=1, msgid=<44E60D8F.5
000009@somewhere.com>, proto=ESMTP, daemon=MTA, relay=mail.domain.com [12.34.56.78]
Aug 18 14:46:30 mail spamc[29734]: skipped message, greater than max message size (256000 bytes)
Aug 18 14:46:30 mail spamass-milter[18732]: Could not extract score from <>
Aug 18 14:46:32 mail sendmail[29721]: k7IIkN6o029721: Milter add: header: X-Virus-Scanned: ClamAV 0.88.2/1684/Fri Aug 18 12:09:44 2
006 on mail.domain.com
Aug 18 14:46:32 mail sendmail[29721]: k7IIkN6o029721: Milter add: header: X-Virus-Status: Clean
Aug 18 14:46:32 mail sendmail[29736]: k7IIkN6o029721: to=<recipient@domain.com>, delay=00:00:09, xdelay=00:00:00, mailer=scalix, pri=2
194607, relay=mail, dsn=2.0.0, stat=Sent (Ok)


although sendmail states 'Sent' it gets placed in the error queue. the following is reported from the scalix monitor cron job regarding this message:

Code: Select all

                         Scalix's Error Queue Contents
-------------------

Reference Number:    3004065                                                   
Message Id:          44E6033E.60005(a)somewhere.com                           
Sender:              user / internet                                           
                     DDT1=RFC-822; DDV1=user@somewhere.com;                   
Subject:             [ Flash Scroller ] Bug Fix                               
Message Type:        MSG                                                       
Sent:                08.18.06


..and checking for the message reference from the command line, it occurs in the error queue:

omstat -q error -m 3004065

Code: Select all

3004065    user / internet        MSG   N Bug Fix  08.18.06                                                   
Sent:                08.18.06


running a omqdump from the command line and listing this message from the error queue results in the following:

Code: Select all


Msg File = ~/data/000007m/002rll1
Access Count = 1
TF File = ~/data/000007m/002rll0
Priority = Normal
TF Info Flags = 0
Filter Route =
Attach File #1 = ~/data/0000032/002rll2
Attach File #2 = ~/data/0000032/002rll3
Attach File #3 = ~/data/0000032/002rll4

HEADER            (DN)  3  0  0  0  0x400  0x1  0  0x0  0x0  0x0  0x0  0x0  "m\
ultipart/mixed;boundary=\"------------050701060102030802050208\""
MSG_INT_ID        (DN)  0  "44E6033E.60005(a)somewhere.com"  "44E6033E.60005(a\
)userselby.com"
CREATE_DATE       (DN)  2006/8/18 18:13.18-240
SUBJECT           (DN)  "[ Flash Scroller ] Bug Fix"  ""  "IA5"  ""  ""
CREATOR           (DN)  0  0  0  0  0  0  "S=user/OU1=internet/DDT1=RFC-822/DD\
V1=user@somewhere.com/INTERNET-ADDR=user@somewhere.com"
  ** Warning - Insufficient fields present  (Record No. 5)
P2_ORIGINATOR     (DN)  0  0  0  0  0  0  "S=user/OU1=internet/DDT1=RFC-822/DD\
V1=user@somewhere.com/INTERNET-ADDR=user <user@somewhere.com>"
  ** Warning - Insufficient fields present  (Record No. 6)
MSG_OBJECT_FILE   (DN)  1110  0  "inetMessageHeader"
MSG_OBJECT_DATA   (DN)  0x1  1  0  <hex data not displayed>
CONTENT_FILE      (DN)  1166  1166  0x2  -1  0  "[ Flash Scroller ] Bug Fix"  \
""  ""  ""  ""  "IA5"  ""  ""  ""  ""
CONTENT_FILE      (DN)  1167  1167  0x0  -1  0  "[ Flash Scroller ] Bug Fix"  \
""  ""  "ISO8859_1"  ""  ""  ""  ""  ""  ""  ""  ""  "text/plain; charset=ISO-\
8859-1; format=flowed"  ""  ""  ""
CONTENT_OBJECT_FILE (DN)  94  0  "inetContentHeader"
CONTENT_OBJECT_DATA (DN)  0x1  1  0  <hex data not displayed>
CONTENT_FILE      (DN)  0  0  0x0  -1  0  "photoScrollFlash8.rar"  "photoScrol\
lFlash8.rar"  ""  ""  ""  "IA5"  ""  ""  ""  ""  ""  ""  "application/octet-st\
ream;name=\"photoScrollFlash8.rar\""  "attachment"  ""  ""
CONTENT_OBJECT_FILE (DN)  176  0  "inetContentHeader"
CONTENT_OBJECT_DATA (DN)  0x1  1  0  <hex data not displayed>
RECIPIENT         (DN)  0x20  0  1  ""  ""  "S=LastName/OU1=mail/OU2=domain\
/CN=FirstName LastName/INTERNET-ADDR=\"FirstName LastName\" <recipient@domain.com>"
OPERATION_TRACE   (DN)  2006/8/23 16:00.41-240  6  ""
OPERATION_TRACE   (DN)  2006/8/23 16:01.06-240  6  ""
OPERATION_TRACE   (DN)  2006/8/23 16:15.23-240  6  ""


names and e-mail addresses have obviously been changed in these entries..

it appears that the attachments are causing the message to be placed on the error queue, which i initially thought was due to the spamc skipped message test.

any ideas based on this additional information?

[btisdall]

Searching the forum on '** Warning - Insufficient fields present' (selecting use all terms) returns some results which suggest this may be an auto-actions issue. Do you have any rules set on the account in question?

[caribk]

Do you have any rules set on the account in question?

yes, i do have a number of rules that move messages to different sub folders based on subjects and sender e-mails addresses.. none for attachments..

i seem to have isolated the problem to be RAR attachments... (works fine attaching a zip, doc, pdf, exe, txt etc. etc..)

i even tried a small RAR file attachment (about 30K) and it too resulted in the message ending up in the error queue, thus refuting the theory that the 256K spamc test had anything to do with this at all..

i've started a new thread http://www.scalix.com/community/viewtopic.php?p=16603 since this problem appears to be different than originally thought.