Introduction

This document describes the meaning of the error message "Scanning Problem: maximum work per expression/data limit exceeded" and how to solve the problems caused due to it.

Background Information

The error message "Scanning Problem: maximum work per expression/data limit exceeded" can be due to dictionary entries, content filters, or message filters that have many regular expression (RegEx) matches. This error can occur because of these reasons:

• When a large number of entries are listed in a dictionary.
• Regular expressions (RegEx) that contain variable length matches (Example: .* , .+ or .{5,}).

Large dictionaries and broad matching regular expressions require significant system resources and should be avoided.

Examples of "maximum work per expression" Error Messages

Mail Logs

Thu Feb 15 12:01:20 2021 Warning: MID #######, 
Message Scanning Problem: maximum work per expression/data limit exceeded

Message Tracking

Message ####### encountered message scanning error: maximum work per expression/data limit exceeded

Application Fault

An application fault occurred: ('egg/filters.py expand_short_url|1570', 
"<type 'exceptions.RuntimeError'>", 'maximum work per expression/data limit exceeded', 
'[egg/omh.py queue_worker_thread|3733] [egg/omh.py process_item|4209] 
[egg/omh.py pass_spamcheck|6402] [egg/omh.py update_url_reporting_info|4951] 
[egg/filters.py get_web_info|1810] [egg/filters.py fetch_urlinfo|1480] 
[egg/filters.py get_url_info|1658] [egg/filters.py get_expanded_url_list|1606] 
[egg/filters.py expand_short_url|1570]') MID: #######

Troubleshoot

Dictionaries

Via the GUI

1. Log into your Secure Email Gateway's GUI.
2. Hover over Mail Policies.
3. Click Dictionaries.
4. Review the dictionaries and entries.

Via the CLI

> dictionaryconfig

Currently configured content dictionaries:
1. Test

Choose the operation you want to perform:
- NEW - Create a new content dictionary.
- EDIT - Modify a content dictionary.
- DELETE - Remove a content dictionary.
- RENAME - Change the name of a content dictionary.
- CLUSTERSET - Set how content dictionaries are configured in a cluster.
- CLUSTERSHOW - Display how content dictionaries are configured in a cluster.
[]>

Review the dictionaries and entries.

Content Filters

Via the GUI

1. Log into your Secure Email Gateway's GUI.
2. Hover over Mail Policies.
3. Click Incoming Content Filters or Outgoing Content Filters.
4. Review the filters.

Via the CLI

> policyconfig

Would you like to configure Incoming Mail Policy or Outgoing Mail Policies or Match Headers Priority?
1. Incoming Mail Policies
2. Outgoing Mail Policies
3. Match Headers Priority
[1]> 1 <- Enter 1 or 2

Incoming Mail Policy Configuration
Name: Anti-Spam: Anti-Virus: Advanced Malware Protection: Graymail: Content Filter:
Outbreak Filters: Advanced Phishing Protection
----- ------------- ----------- ---------------------------- ------------- -----------------
---------------- ----------------------------
DEFAULT Off Sophos Off Off Enabled
Retention Time: N/A

Virus: 15 minutes

Choose the operation you want to perform:
- NEW - Create a new policy
- EDIT - Edit an existing policy
- PRINT - Print all policies
- FILTERS - Edit content filters
- CLUSTERSET - Set how Incoming Mail Policies are configured in a cluster
- CLUSTERSHOW - Display how Incoming Mail Policies are configured in a cluster
[]> filters

Defined filters:
1. example_filter_one
2. example_filter_two

Choose the operation you want to perform:
- NEW - Create a new filter
- EDIT - Edit an existing filter
- DELETE - Delete a filter
- PRINT - Print all filters
- MOVE - Reorder a filter
- RENAME - Rename a filter

Review the filters. Repeat for Outgoing Content Filters if needed.

Message Filters

Via the GUI

Not available.

Via the CLI

> filters

Choose the operation you want to perform:
- NEW - Create a new filter.
- DELETE - Remove a filter.
- IMPORT - Import a filter script from a file.
- EXPORT - Export filters to a file
- MOVE - Move a filter to a different position.
- SET - Set a filter attribute.
- LIST - List the filters.
- DETAIL - Get detailed information on the filters.
- LOGCONFIG - Configure log subscriptions used by filters.
- ROLLOVERNOW - Roll over a filter log file.
- CLUSTERSET - Set how filters are configured in a cluster.
- CLUSTERSHOW - Display how filters are configured in a cluster.
[]> list

Num Active Valid Name
1 Y Y example_message_filter

Review the filters.

Related Information

• Cisco Secure Email Gateway End-User Guides
• Cisco Secure Email Gateway Release Notes
• Technical Support & Documentation - Cisco Systems