Performance and accuracy issues
dahlberg at BUCKNELL.EDU
Fri Feb 13 18:42:02 GMT 2004
Michael Dahlberg [dahlberg at bucknell.edu] wrote:
> Fanatastic piece of software...I can't imagine running a mail server
> without it. However, the latest upgrade (from 4.13-3 to 4.26.8) has
> uncovered a few issues.
> A little about our config: MailScanner (4.26.8) runs with Sophos
> (3.78d) on a dual processor Sun 220R with 2GB RAM. The
> MailScanner.conf file is set to start 10 child processes which will
> scan a max of 30 messages. MailScanner also runs in queue mode rather
> than batch. We do no spam analysis, just virus scanning. I've also
> installed the first Message.pm perl mod that Julian Fields released a
> couple of days ago.
> I've noticed that when running the SAVI engine (Virus Scanner =
> sophossavi), rather than `sweep` (Virus Scanner = sophos) it
> takes about 3x as long with the SAVI engine (approx. 3 min to scan 100
> messages using SAVI versus 1 min with sweep). Also when I use the
> SAVI engine, more MyDoom-infected email messages are found and
> Is this the experience of other readers of this list? Does anyone
> have an explanation or advice on which virus scanner (Sophos or SAVI)
> to use?
Unfortunately, we had to downgrade MailScanner back to 4.13-3.
The rate at which messages were being scanned and moved to an
outbound mail queue was so slow that mail delivery times had
increased to half an hour and the inbound queue size was steadily
Using the same Sophos installation, we downgraded MailScanner back
to 4.13-3. While we are now keeping up with the mail flow on
campus, there are a number of MyDoom-infected email messages passing
through MailScanner. These are the messages with an incomplete MIME
header, which prompted the release of the new Message.pm file. This
was the reason for the upgrade.
I don't believe my problems are related to Sophos or the mail
delivery method since the downgrade (which preserved both) solved
Any suggestions would be greatly appreciated.
More information about the MailScanner