IronPort Anti-Spam Scanning: Maximum Message Size to Scan

[mychrislo]

What's the reasonable size can be set (beyond the recommended 256k)?

Our incoming clean volume of messages are around 20k - 30k. Model is a single c150.

We found there are messages larger than this size and bypass our anti-spam. Causing some management level users to complain.

How do you guys solve this kind of problem?

Thanks.

Chris

[Ken Stieers]

How big are the messages that are slipping through?

Set the limits to catch those...

If that burries the box, hand the bosses the bill for an upgrade to a C3xx...

You'll need to get off the 150 box anyway, its EOL soon...

Currently I've got a C370 (overkill for the amount of traffic we have now...5200 inbound clean messages today)

Its limits are set to scan everything under 1M, don't scan anything over 25M, and scan for up to 120 seconds.

You could also toss those suspect messages over to Cisco to find out why they aren't getting caught as spam... there may be some tweaking that can be done...

[mychrislo]

My statistics for 2 months logs

# of email unscanned due to ovesized CASE limit

If I double 256k to 512k. 30% of those unscanned emails can be scanned

If I go to 800k, ~50%.