Scanning Order

[Chris Russell]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Hi All,
 
  This is more than likely a question for Julian but I`ll throw it open.
 
  Is there a specific reason MailScanner does MCP/Spam checks before AV ? 
 
  Ok, Reasoning:
 
    I was looking into our systems this evening, and from our stats, Pretty much 100% of our virus infected email is simply deleted. For the most part theres very little reason to actually look at these messages as they are often the result of mass-mailing virus's etc.
 
    With this in mind, would it be more efficient to virus scan the email first ? This would cut out spam/mcp scanning for infected messages (dependant on the action), and cut down on the number of messages required to be spam/MCP scanned, which seems to take the longest time/ add the most significant load to the process.
 
    I've looked into /usr/sbin/MailScanner and thanks to Julian's coding, it doesn't look too difficult to change (** highly preliminary findings here!), so does anyone have any thoughts on whether AV->MCP/SPAM may be a better approach to take ?
 
Cheers,
 
Chris
 
 
  
 
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!