Skip 3rd party virus scan if MailScanner identifies by filename rule?

[Julian Field]

No, you can't do that. However, it would actually make very little
difference to the overall system load or speed. Scanning 1 extra file with
a virus scanner takes *very* little time. This is far less time than it
takes to extract the attachments and decode the message in the first place.
The decoding (the expensive bit) is all written in C and goes as fast as
your box will let it :-)

At 01:46 03/04/2004, you wrote:
>Hello.  Again, let me say that I've only been running MailScanner for a
>little less than a month, but it is absolutely fabulous--it has been a
>godsend for us.  Just upgraded to the latest stable release.
>
>I was searching the list archives, trying to find a thread on this, but I
>must not be searching well.  I did see a long thread back in January about
>scanning for viruses before spam, instead of the other way around; I think
>Julian at the time had said he didn't see the value in scanning messages
>you'd be throwing away.
>
>Let me ask a different question, and my apologies in advance if it's in the
>list archives and I just haven't found it, or if I'm missing something
>obvious.  (We deliver Spam, but tag it, and that's working well.)
>
>We run MailScanner with the ClamAVModule. Our system is pretty heavily loaded.
>
>I've kept the defaults in "filename.rules.conf," and we're throwing away
>any messages that match those rules (after announcing that policy to our
>users, of course).  We also throw away messages ClamAV flags as having a
>virus.  In most cases, those are one and the same--it is a rare case that
>ClamAV finds a virus MailScanner hasn't already labeled as having a bad
>filename, and vice versa.
>
>Since it is rare, I wondered if there were some way to tell MailScanner not
>to bother calling ClamAV to perform a second scan on a message if
>MailScanner has already flagged it as bad (or vice versa--I'm not sure who
>does the test first).
>
>TIA for any responses; and my apologies again if this has been covered.
>
>Regardless, thanks again, Julian!
>
>sjlist at heidelberg.edu

--
Julian Field
www.MailScanner.info
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654