clamav not working?

[Julian Field]

On 24/11/2009 02:00, Frank Cusack wrote:
> Looking at ProcessClamAVOutput() in SweepViruses.pm I see a lot of
> pattern matching which is hurting my brain.  Ok, that is fine for
> logging but why doesn't it just check the return value of clamav-wrapper
> (which passes the return value of clamscan) to determine success?
For the very good reason that part of MailScanner's high speed comes 
from the fact that it checks many messages at a time. So checking the 
return value is useless as it would not tell you which message contained 
the virus. If it worked in the same slow way as its competition, it 
would check each message individually, at which point it could use the 
return code. But scanning 5 files takes only fractionally longer than 
scanning 1 file, as the largest proportion of the time in the virus 
scanner is when it is starting up and reading all its virus pattern 
databases. So to gain a huge increase in speed, I scan many messages at 
once.

If you want to see what happens when you scan each message individually, 
set the "Max Unsafe Messages Per Scan = 1" and watch how slowly it goes!

There is method in my madness. Just because you don't see a good reason 
for a design decision, it does not mean there *isn't* a good reason for 
it, just that you don't see it.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.