Hi Patrick (and all others)
thanks for your reply.
I understand now: Exim does not skip Spamassassin, but SpamAssassin
returns big e-mails to Exim without touching them at all.
Indeed, I should consider, not to increase the limit of SpamAssassin.
My server runs out of memory often enough :(
rspamd is a good hint. I should try to find out more about it.
I wonder how you configure Exim to pass smaller messages to one filter
and bigger messages to another filter.
It seems to me, that using SpamAssassin is like shooting with guns
against flies. I wrote my own SpamAssassin plugin which detects a big
lot of spam, but actually I would be glad if I would not need
SpamAssassin to run my plugin. I would say, 80% of all spam is rather
easy to detect, and a small fast program could do it as well. Only the
rest of 20% should be checked by SpamAssassin using Spamhaus block
lists and other tricky stuff.
BR
Paul
Am 2017-09-01 14:26, schrieb Patrick von der Hagen:
> Hi Paul,
>
> SpamAssassin has some VERY expensive regular expressions, which result
> in extreme memory usage. If the limit is completely disabled, you
> shouldn't be surprised if a couple of spamd-children consume all your
> memory, which can render your server pretty much useless.
>
> Therefore, such a limit is common practice and searching for the sweet
> spot of "spammers usually send smaller emails" and "spamassassin can
> still cope" can be hard.
>
> On my servers, I use SpamAssassin for smaller messages and rspamd for
> the big ones. rspamd is way more efficient regarding resource usage.
> Still need to properly evaluate SpamAssassin vs. rspamd for my setup,
> since I'd love to replace SpamAssassin...
>
> Yours,
> Patrick.
>
>
> Am 29.08.2017 um 23:03 schrieb Paul Lenz:
>> Hello everybody,
>>
>> I am using Exim4 (version: 4.80-7+deb7u5) on a Debian system with
>> SpamAssassin. Everything works very fine except the case if an e-mail
>> has big attachments. Unfortunately it is quite common that lottery
>> spammers attach a pdf file which has 700 kB or even 1200 kB.
>>
>> Those e-mails have a header entry like this:
>>
>> Received: from mail by [[MY_SERVER]] with spam-scanned (Exim 4.80 #2
>> (Debian))
>> id 1dknc6-0006nP-BB
>> for <[[MY_ADDRESS]]>; Thu, 24 Aug 2017 10:35:42 +0200
>>
>> but they are not scanned and there are no entries made by
>> SpamAssassin.
>>
>> I tried to find solutions in a Debian forum, but nobody could help me.
>>
>> - Why are those e-mails skipped?
>>
>> - How comes "spam-scanned" into the header if the e-mail was not
>> scanned?
>>
>> - Is there a size limit which I can change?
>>
>> - If there is no solution - how can I include a small self-written
>> Perl script as additional filter?
>>
>> Thanks in advance
>> Paul Lenz
