MailScanner vs. Amavisd

[Mariano Absatz]

Mike,

appart from whatever might have happened with F-Prot, if you see viruses 
passing thru MailScanner, you should first suspect of the AV scanner and not 
MailScanner itself.

Even more, ignoring the products themselves, and using just commonsense, if 
you pass messages first thru MailScanner and then thru Amavisd whatever virus 
that was missed by MailScanner might be catched by Amavisd, BUT there is NO 
WAY that MailScanner will catch viruses missed by Amavisd, since, by the time 
Amavisd is thru MailScanner will not be called in, and in fact, it must have 
already caught this viruses before Amavisd had a chance to look at them... 
this is why Kevin suggested you reversed the order...

But then, if we're talking viruses and you use AV-a in MailScanner and AV-a + 
AV-b in Amavisd, there's a clear advantage to Amavisd... you should run the 
same set of antivirus scanners in both and then any differences that would 
come around will probably be due to the integrated 'inteligence' or 
'vulnerability-checks' of each tool.

I don't know Amavisd, I choose MailScanner at first sight because of the way 
it handles messages in batches (that that people of Amavisd seem to not 
like), and for not pretending it's an MTA, 'cause SMTP is really a hard beast 
to handle and that is better left to experienced MTA developers (sendmail, 
postfix, exim, zmailer), MailScanner just stands in-between, and, when I hit 
a real problem because of an underconfigured machine, it took me 5 minutes 
and a symbolic link to take MailScanner out of the loop and leave the MTA 
alone processing messages... I don't think you can do that with Amavisd in an 
emergency...

Regards.

El 11 May 2004 a las 13:06, Muenz, Michael escribió:

> Hi,
> 
> > In this case the comparison is unfair then, since you say MailScanner
> > doesnt catch all the viruses that amavisd catches, yet you have an extra
> > virus scanner (a VERY good one) installed on amavisd - you should be
> > VERY careful about posting your conclusions and not including all the
> > facts as they could very easily be the difference of 10 viruses per day ?
> 
> There was an update last days of F-Prot. They told about problems
> with decoding MIME attachments. And I also have added clamavmodule
> to MS.
> Result:
> Last 24 hours no virus get through.
> 
> Sorry that my first thought was that MS is the main problem.
> 
> - Michael

--
Mariano Absatz
El Baby
----------------------------------------------------------
I work 40 hours a week to be this poor.

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html