So I was trying to find out why we got this message in the message tracking logs for an email today…
Ironport MID 42780863 was too big (337410/262144) for scanning by Outbreak Filters
Due to size vs. speed concerns there is a limit to the size of items checked against the Outbreak Filters. I believe the default setting’s 128K, but it can be upped to increase efficacy at the cost of processing power.
The setting’s located at Management -> Security Services -> Outbreak Filters. It’s reflected in the second half of the number/number in the log file, 262144.
