clamav not working?
MailScanner at ecs.soton.ac.uk
Tue Nov 24 09:36:40 GMT 2009
On 24/11/2009 02:00, Frank Cusack wrote:
> Looking at ProcessClamAVOutput() in SweepViruses.pm I see a lot of
> pattern matching which is hurting my brain. Ok, that is fine for
> logging but why doesn't it just check the return value of clamav-wrapper
> (which passes the return value of clamscan) to determine success?
For the very good reason that part of MailScanner's high speed comes
from the fact that it checks many messages at a time. So checking the
return value is useless as it would not tell you which message contained
the virus. If it worked in the same slow way as its competition, it
would check each message individually, at which point it could use the
return code. But scanning 5 files takes only fractionally longer than
scanning 1 file, as the largest proportion of the time in the virus
scanner is when it is starting up and reading all its virus pattern
databases. So to gain a huge increase in speed, I scan many messages at
If you want to see what happens when you scan each message individually,
set the "Max Unsafe Messages Per Scan = 1" and watch how slowly it goes!
There is method in my madness. Just because you don't see a good reason
for a design decision, it does not mean there *isn't* a good reason for
it, just that you don't see it.
Julian Field MEng CITP CEng
Buy the MailScanner book at www.MailScanner.info/store
Need help customising MailScanner?
Need help fixing or optimising your systems?
Need help getting you started solving new requirements from your boss?
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner