Escaping / Lifting Message size fixed limit

[Barty]

Good afternoon all,

Hoping this will be a very quick fix - one of our business users has a scheduled report that when run, produces an email attachment (CSV) of around 12MB in size. However, the email is not generating despite the success of the schedule due to the following:-

ERROR:root:(552, '5.3.4 Message size exceeds fixed limit

I have searched through here and can see varying responses as to how to increase the action.email.maxresults, but this isn't the issue, the issue seems to be a limit of around 10MB on the email / attachment from the resulting report. Our internal mail size limit is 25MB so i'm fairly confident that it is not our internal throttle controls.

Could someone advise me as to where this default limitation could be lifted / increased? I cannot see an obvious entry within the limits.conf (but leads me to believe i need to therefor add one?).

Bart

[Barty]

Spot on! Thank you for confirming, I'll go back to the business as there is no way that I will get the mail limit increased

[xpac]

PS: You can contact Splunk support and put your vote to enhancement request SPL-142222, that I field a few days ago.
It's asking to allow having attachments to alert mails compressed, which would most likely reduce their size a lot. 🙂

[xpac · Accepted solution]

Hey, that's actually a message from your mail server.
SMTP error 552 relates to the mail being too big. CSVs can get quite big, as they get no compression, and also because of how data attachments in mails work, the actual mail is about 33% bigger than the CSV that's attached to it.

Long story short - your attachment is too big for your mailserver, so you either have to get your mail server admin to raise that limit, or reduce the size of the report.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂