Cisco Email Security Appliance

How do I filter messages that are too large?

Document ID: 117885

Updated: Jul 07, 2014

Contributed by Scott Roeder and Enrico Werner, Cisco TAC Engineers.



How do I filter messages that are too large?

You can filter on message or attachment size with a message filter. (You cannot use content filters to filter on message or attachment size.) For example, the following message filter intercepts messages that are larger than 7 MB coming in to the InboundMail listener (for example, from the Internet). These messages are dropped, and a notification is sent back to the original sender (actually the Envelope From address) telling them that the message was dropped and why:

if ((recv-listener == "InboundMail") AND (body-size > 7M)) {
notify ('$EnvelopeFrom',
'Your message exceeded the allowed 7MB size limit');
drop ();

In the following filter, any attachment that is larger than 1024K (1 MB) will be dropped out of a message. The rest of the message will continue on through. However, the recipients will be notified that an attachment was dropped so that they can take further action. This filter applies to messages both inbound and outbound, because it does not trap on a particular listener. In this filter, 'attach.size.notify' is a customized text message that is previously created by the CLI command 'textconfig' that might contain additional information about what happened and why it happened.

if (attachment-size >= 1M){
notify ('$EnvelopeRecipients',
'[$Filtername] Dropped Attachment Notification',
Updated: Jul 07, 2014
Document ID: 117885