handling huge media attachments

mkoch7811_ironport · ‎04-05-2005

I grew tired of getting complaints from upper management whenever our mail server's performance degraded. In every case, I could trace the problem to one or more messages containing huge attachments (>10MB), and they almost never were business-related. I came up with the following solution, and the complaints have dropped to almost nothing.

Step 1: Create a notification message using the textconfig command (the text of which is at the bottom of this post).

Step 2: Create a content filter containing the following:
CONDITIONS:
Any of the following:
attachment-filename==".wmv$"
attachment-filetype=="mpeg"
attachment-filetype=="mov"
attachment-filetype=="avi"
ACTIONS:
notify("postmaster@mydomain.com,$EnvelopeRecipients","Inbound media file detected","","media.notification")
quarantine("Policy")
Step 3: Add the new content filter to your incoming mail policy

Basically, this filter quarantines all of those huge, bandwidth-wasting movie files that users send to each other. The intended recipient receives an email containing the text in the "media.notification" template. The "Policy" quarantine area is configured for a 24 hour limit, so if the user doesn't request the release of the message within 24 hours of receipt, the system will automatically delete it.

Here is the text of the media.notification template:

Someone recently sent you an email message containing a media file attachment. This message has been blocked and is currently being held in a quarantine area.

Personal emails with large attachments cause network congestion since they are not only unnecessary, but are often sent to a large list of recipients and usually include relatively huge media file-type attachments such as mp3, picture, or movie files. These files tend to be quite large, and have an adverse impact on the performance of the entire email system. This directly affects our ability to do business in a timely manner, and so we have instituted an email filtering process that looks for these types of messages.

If your message is NOT business-related, then you don't need to do anything, and your message will be permanently deleted during the system's routine maintenance.

However, if your message is directly related to company business, please contact the Service Desk at x7755, and after review, your message will be released from the quarantine area and delivered to your mailbox.

Thank you for your cooperation and understanding.

Hope you find it useful.
Mike

Erich_ironport · ‎04-05-2005

What are the maximum attachment sizes you allow inbound?
Ours is 10MB.

What are the maximum attachment sizes you allow outbound?
Ours is 10MB.

Where do you filter based on size, IronPort, Groupware (Exchange/Notes) or client?
Both IronPort and Exchange in our case.

Erich

tminchin_ironport · ‎04-07-2005

We allow up to 100 megabyte attachments. We are working down from a previous unlimited attachment size - we suffered when people sent multiple ISO files or their entire computer's C drive via email...

mkoch7811_ironport · ‎04-07-2005

What are the maximum attachment sizes you allow inbound?  
Ours is 10MB.

What are the maximum attachment sizes you allow outbound?  
Ours is 10MB.

Where do you filter based on size, IronPort, Groupware (Exchange/Notes) or client?
Both IronPort and Exchange in our case.

Erich

Ours is set to 15 MB on both the C30 and the Exchange servers. I have another filter set on the C30 that auto-responds to any inbound messages over 15 MB, letting the sender know their message was dropped and why. This has worked pretty well, as I've seen drops followed closely by smaller followups.

Mike

shannon.hagan · ‎04-07-2005

You would be better off having the condition
attachment-filetype=="mpeg|mov|avi"

instead of:
attachment-filetype=="mpeg"
attachment-filetype=="mov"
attachment-filetype=="avi"

mkoch7811_ironport · ‎04-08-2005

I agree, but unless I'm missing it, the GUI doesn't provide a way to do that, since the filetypes are in a dropdown box and doesn't allow for multi-selects. It can be done in a message filter, but I've converted most of my message filters to content filters, and I find them easier to maintain from the GUI.

Mike

shannon.hagan · ‎04-08-2005

In the text field, you just put mpeg|mov|avi instead of putting one.

mkoch7811_ironport · ‎04-11-2005

There is no text field. As I said before, it's a dropdown list, and does not accept any input.