Scanning Order

[Richard Smith]

While I agree with spam checking first over virus checking for the  
same reasons given, It would be nice to have a feature in MailScanner  
to assign priorities to various parts. i.e. RBL checks, then  
spamassassin, then MCP, then virus checker 1, then virus checker 2,  
or virus checker 2, then spamassassin, then RBL checks, then virus  
checker 1, then MCP... with the default setup being the status quo. I  
for 1 would like to have the RBL checks done last (I use milter- 
greylist as well).

Regards,
Richard Smith
Technician, Media Design School
email: richard at mediadesign.school.nz
Phone: +64-9-303 0402 Ext: 711
DDI: +64-9-303 5594 or Cell: +64-21-114 3547


On 20/09/2005, at 8:57 AM, Michael Baird wrote:

> Well, in my setup, scanning for viruses first would probably be
> beneficial sometimes. I drop the virus infected emails immediately,
> while for spam, I actually just score them, since we have a opt-in
> system, and I use generated procmail rules to deal with the mail based
> on the score. If it was checking viruses first, I would save the
> overhead of spamassassin for some messages, which I would discard as
> viruses immediately. It's not a big deal, I'm sure I could move virus
> scanning to a milter or something, but would lose the MailScanner
> batching, and having viruses and spam handled through the same config.
>
> Regards
> Michael Baird
>
>
>> Most of your mail (say 75%) is spam. Relatively, very little of it
>> (say 5%) is a virus.
>> So if you do spam checks first, then delete all the spam, you don't
>> need to do anything further with 75% of your incoming mail. So the
>> overhead of all further processing of 75% of your mail never happens.
>> That includes all the expensive checks like the phishing net, as well
>> as the straight virus scanning.
>>
>> On 18 Sep 2005, at 04:16, Chris Russell wrote:
>>
>>
>>> Hi All,
>>>
>>>   This is more than likely a question for Julian but I`ll throw it
>>> open.
>>>
>>>   Is there a specific reason MailScanner does MCP/Spam checks
>>> before AV ?
>>>
>>>   Ok, Reasoning:
>>>
>>>     I was looking into our systems this evening, and from our
>>> stats, Pretty much 100% of our virus infected email is simply
>>> deleted. For the most part theres very little reason to actually
>>> look at these messages as they are often the result of mass-mailing
>>> virus's etc.
>>>
>>>     With this in mind, would it be more efficient to virus scan the
>>> email first ? This would cut out spam/mcp scanning for infected
>>> messages (dependant on the action), and cut down on the number of
>>> messages required to be spam/MCP scanned, which seems to take the
>>> longest time/ add the most significant load to the process.
>>>
>>>     I've looked into /usr/sbin/MailScanner and thanks to Julian's
>>> coding, it doesn't look too difficult to change (** highly
>>> preliminary findings here!), so does anyone have any thoughts on
>>> whether AV->MCP/SPAM may be a better approach to take ?
>>>
>>> Cheers,
>>>
>>> Chris
>>>
>>>
>>>
>>>
>>>
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>


-- 
http://www.mediadesign.school.nz/

CAUTION: This communication is confidential and may be legally privileged.
If you have received it in error you must not use, disclose, copy or retain
it. Please immediately notify us by return email and then delete the email.

This message has been scanned for viruses and dangerous content by
MailScanner with McAfee UVScan, and is believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!