Introduction
This document describes the "Size Limit Exceeded" error message found in the mail logs of the Cisco Email Security Appliance (ESA).
What does "Message Scanning Problem: Size Limit Exceeded" mean?
In review of mail logs and message tracking on the ESA, you may see the following error and need to determine what the issue is:
Tue Sep 9 13:37:35 2014 Warning: MID 15180223, Message Scanning Problem: Size
Limit Exceeded
Scanning on the ESA has a global limit on large messages. If a message is too large, it is generally exempt from many scans, and sent to the end recipient(s).
To change the message-scan limit from the CLI, use scanconfig. You will need to make adjustments to the "maximum size of attachment to scan" options as highlighted.
Note: Remember that the larger the scan size is set, the more appliance overhead and resources are used.
myesa.loca> scanconfig
There are currently 5 attachment type mappings configured to be SKIPPED.
Choose the operation you want to perform:
- NEW - Add a new entry.
- DELETE - Remove an entry.
- SETUP - Configure scanning behavior.
- IMPORT - Load mappings from a file.
- EXPORT - Save mappings to a file.
- PRINT - Display the list.
- CLEAR - Remove all entries.
- SMIME - Configure S/MIME unpacking.
[]> setup
1. Scan only attachments with MIME types or fingerprints in the list.
2. Skip attachments with MIME types or fingerprints in the list.
Choose one:
[2]>
Enter the maximum depth of attachment recursion to scan:
[5]>
Enter the maximum size of attachment to scan:
[5242880]>
Do you want to scan attachment metadata? [Y]>
Enter the attachment scanning timeout (in seconds):
[1]>
If a message has attachments that were not scanned for any reason (e.g. because
of size, depth limits, or scanning timeout), assume the attachment matches the
search pattern? [N]>
In case of a content or message filter error, should all filters be bypassed? [Y]>
If a message could not be deconstructed into its component parts in order to remove
specified attachments, the system should:
1. Deliver
2. Bounce
3. Drop
[1]>
Configure encoding to use when none is specified for plain body text or anything with
MIME type plain/text or plain/html.
1. US-ASCII
2. Unicode (UTF-8)
3. Unicode (UTF-16)
4. Western European/Latin-1 (ISO 8859-1)
5. Western European/Latin-1 (Windows CP1252)
6. Traditional Chinese (Big 5)
7. Simplified Chinese (GB 2312)
8. Simplified Chinese (HZ GB 2312)
9. Korean (ISO 2022-KR)
10. Korean (KS-C-5601/EUC-KR)
11. Japanese (Shift-JIS (X0123))
12. Japanese (ISO-2022-JP)
13. Japanese (EUC)
[1]
If you make any changes and adjustments to the settings, be sure to commit all changes from the main CLI prompt.
In many cases, you will find that the particular message may have exceeded scanning, but did process and deliver as originally expected. You will need to research and reivew your mail logs for the final disposition of the original MID.
Related Information
Feedback