Server Spec for MailScanner

[Richard Lynch]

Pete wrote:

> Richard Lynch wrote:
>
>> This brings up something I've been wondering about.  I'm currently
>> running three scanners.  It was my impression that the overhead was
>> mostly in the decoding phase so adding additional scanners didn't really
>> cost that much.  Is that correct or am I mistaken?
>>
>>
> which 3? Do you ever have any live virus instance beyond mailscanner ?
> Which 1 or 2 did you use before adding the third, did it appear to make
> a large difference in either performance, or detection rates?


F-Prot, Mcafee, and ClamAV.  The last one added was Mcafee.  It turned
out that we already had a site license for it so there was no additional
outlay in cash, at least until the contract expires.  I didn't really
notice any degradation but there may have been.  We process a good bit
more mail now than we were at the time I added it.  Generally, Mcafee
never caught anything that the others missed.  Sometimes F-prot was
first with the updates and other times ClamAV was first.  I'm certainly
going to keep running those two.  When the rash of protected zip viruses
began Mcafee was catching some of them while the others weren't catching
any of them.  That's all been addressed now that Julian has added
protected zip file rejection support.  Given that, at one time or
another, one of the three has caught something that the others did not
I'm thinking maybe I need all three.  On the other hand, the load on my
boxes continues to go up and if it's real expensive in terms of
performance I may decide to drop Mcafee.

--
Richard E. Lynch <rich at mail.wvnet.edu>
Systems Programming Manager
West Virginia Network (WVNET)
837 Chestnut Ridge Road
Morgantown, WV  26505
(304) 293-5192 x243