Skip scan for viruses
Kevin_Miller at CI.JUNEAU.AK.US
Fri Jan 30 19:49:22 GMT 2004
>From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK]
>Let me have a think.
>I'll get back to you.
Here's my tuppence worth. Currently, I deep six virii, forward spam to
Alphonse Spamdog (a dummy user in Exchange). I can easily recover a false
positive that way. I would hazard a guess that *most* people quarentine
spam and delete virus infected messages. I know there are some that drop
spam and others that quarentine viruses, but my gut feeling is they're
(especially the latter) the minority. I may well be wrong of course.
For every message, both spam and virus scanning happens. If the order were
reversed, I could scan for virii, delete the message if infected, and not
have to do the spam scanning. This would entail a status check between
processes of course - not sure if there is one now or if it all happens at
the end of the spam/virus scan cycle.
During high spam, low virus times, the utilization would be roughly the same
regardless of the order as both processes happen and the percentage of virus
infected messages is pretty low. During a high virus, high spam (I don't
see spam abating significantly like viruses do)
I would drop a lot of virii before they got to the spam stage thus saving
some CPU cycles.
So, for us, virus scanning first makes the most sense, assuming the
mechanism is in place to drop the message w/o bothering w/spam scanning.
Either way though, I figure we outta start refering to JF as Sir Julian
irrespective of what the Queen does. So what's her email address again? <g>
Kevin Miller Registered Linux User No: 307357
CBJ MIS Dept. Network Systems Administrator, Mail
155 South Seward Street ph: (907) 586-0242
Juneau, Alaska 99801 fax: (907 586-4500
More information about the MailScanner