multiple virus scanners, what happens?

[Jeff A. Earickson]

Julian,

I added ClamAV 0.60 onto my mail server today (Solaris 9, Sophos
3.72, MS 4.22-5) as a second anti-virus after sophossavi.  I've noticed
in the syslog that when MS hits a virus, both anti-virus guys check
the message and complain to syslog.  While this is good, it seems
like a waste of CPU cycles to have both give a thumbs down.  Why not
"OR" instead of "AND" for the list of virus scanners?  Or make this
user configurable?  Personally, I'm interested in the cases where
Clam catches something that Sophos missed.

Another question: do people run "freshclam" from their root crontab,
or from user "clamav" crontab?

--- Jeff Earickson