Chris.Russell at KNOWLEDGEIT.CO.UK
Sun Sep 18 04:16:14 IST 2005
[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
This is more than likely a question for Julian but I`ll throw it open.
Is there a specific reason MailScanner does MCP/Spam checks before AV ?
I was looking into our systems this evening, and from our stats, Pretty much 100% of our virus infected email is simply deleted. For the most part theres very little reason to actually look at these messages as they are often the result of mass-mailing virus's etc.
With this in mind, would it be more efficient to virus scan the email first ? This would cut out spam/mcp scanning for infected messages (dependant on the action), and cut down on the number of messages required to be spam/MCP scanned, which seems to take the longest time/ add the most significant load to the process.
I've looked into /usr/sbin/MailScanner and thanks to Julian's coding, it doesn't look too difficult to change (** highly preliminary findings here!), so does anyone have any thoughts on whether AV->MCP/SPAM may be a better approach to take ?
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
Support MailScanner development - buy the book off the website!
More information about the MailScanner