Best way to run ClamAV???

[Matt Kettler]

Michael Masse wrote:
> I just updated to MS 4.60-1 as well as SA 3.2 / Clam 0.90.3 via Jules' automatic installer.    There has been so much list traffic about clamscan vs clamd vs clamavmodule that I can't make out which one is what I'm supposed to be running.   I'm just running the default clamscam and that can't be right because it's maxing out the cpu to 100%.     Can someone please set me straight on how I should be running ClamAV?

clamscan: most expensive CPU-wise, but involves no extra setup. This just
executes the clamscan command-line tool. This causes the signature database to
be re-read for each object scanned and can be pretty CPU intensive compared to
the others.

clamav module: less expensive than clamscan CPU-wise, but needs the Mail::ClamAV
perl module. This method loads a copy of the libclamav scanner library into
MailScanner and keeps it resident, using it to perform scans without needing to
re-read the signature libraries, etc. It can be somewhat touchy about what
versions of Mail::ClamAV work with various versions of clamav.

clamd: less expensive than clamscan CPU-wise, but needs clamd running and is
relatively new code. This causes MailScanner to connect to clamd's socket and
use that for scanning. Since clamd is already resident, there's no need to
re-read signatures. Since it's using clamd, which comes with clamav, there's no
real version-compatibility problems like with the module, at least in theory.