jean-paul natola wrote: > I didnt add this to my previous thread (timing out) because it seems to
> be a different issue
>
> I saw a message trying to get scanned by clam , which eventually
> timed-out, the message was 21 megabytes-
> My question is why did it even attempt to scan it when I have this in my
> /usr/local/etc/exim/configure file
>
> message_size_limit = 20M
>
> should it not have immediately rejected it?
If it was 30Mb and still getting through, I'd be worried, but 20M and
21Mb are so close that it can usually be accounted for in the
differences between multiplication factors of 1000 vs 1024, size on
disk, rounding errors etc.
All the crud in the /var/spool/exim directory is not necessarily a good
indication of the size of the message. Due to MIME bombs or other
annoyances you may get a lot more files in there than the original email.
The log entry for the email should contain an S= entry that will tell
you how large exim thought the message was, but that might only happen
if it gets accepted or reject. Any oversize messages will also get
logged as being rejected.
Of course, any good mail server or client should not have submitted the
message in the first place as the size restriction was advertised to the
sender at HELO time.
