MailScanner + Sophos + McAfee

[Julian Field]

At 12:27 24/06/2002, you wrote:
>I am running MailScanner 3.20-6 with both Sophos and McAfee A-V
>software. The mailscanner.conf file says:
>
>  Virus Scanner = sophos, mcafee
>  ...
>  Sweep = /usr/local/Sophos/bin/sophoswrapper,
>/usr/local/uvscan/mcafeewrapper
>
>I had assumed that if a virus was _found_ by Sophos (first in list) then
>MailScanner would not bother calling McAfee. However it does and this
>behaviour pre-dates 3.30-6.
>
>Is there a reason for this?

Messages are handled in batches for efficiency (saves cranking up the
anti-virus engine separately for each message). As a result the batch would
have to be split and separated to avoid calling both scanners. As your
machine load grows, the batches get bigger, so the overhead of calling a
2nd scanner on the 1 or 2 infected messages in the batch actually becomes less.

On a very lightly loaded machine, the load is increased; but on a busy
machine the change in load is nearly undetectable.

So changing this behaviour (which would be quite a big mod to the code)
wouldn't actually gain you anything very noticeable.
--
Julian Field                Teaching Systems Manager
jkf at ecs.soton.ac.uk         Dept. of Electronics & Computer Science
Tel. 023 8059 2817          University of Southampton
                             Southampton SO17 1BJ