[Mimedefang] How to catch large binary spam efficiently ?

[Jeff Makey]

Henrik K asked:
>where exactly does SpamAssassin core decide anything?

This is drifting off-topic, but in the _run_file subroutine in
ArchiveIterator.pm, SA refuses to scan messages whose total size is
greater than 256 kilobytes (not 100K as I implied previously).  This
is to limit the memory used by SA, which seems to exceed 10 times the
size of the message being scanned.

In my setup I have increased that limit in SpamAssassin to 1 megabyte
and modified my mimedefang-filter to only scan messages where the
total size of the text part(s) are less than 100 kilobytes.  Non-text
MIME attachments do not contribute to SA's explosive use of memory, so
this works quite well.

I do occasionally get spam where the text size exceeds 100 KB, but so
far it hasn't been enough to justify the memory cost of processing
messages that large.

                          :: Jeff Makey
                             jeff at sdsc.edu