virus scan not available -> no virus check!

mog lists at elasticmind.net
Sun Nov 29 12:38:08 GMT 2009



Frank Cusack wrote:
> On November 28, 2009 1:56:21 PM +0000 Jules Field 
> <MailScanner at ecs.soton.ac.uk> wrote:
>> Frank,
>>
>> I quite understand your point, and will see what I can do to address it.
>> It's only really a problem with clamd and the other "daemon-based" virus
>> scanners. I can't promise anything, but I will take a look.
>>
>> What exactly would you like MailScanner to do in such a situation?
>>
>> And, believe it or not, I can't remember anyone ever bringing this up
>> before as a major point. Basically you currently have to be sure your
>> daemons are running properly for it to work correctly.
>>
>> If the daemon cannot be contacted, what would you prefer?
>> a) mail stops flowing
>> b) mail is all quarantined
>> c) something else
>>
>> (a) is possibly preferred, I don't think (b) is a good idea. It needs to
>> be some fairly simple action, I don't want to have to write reams of 
>> code
>> for this unlikely event.
>
> (a) would be my preference.  An alert wouldn't even need to be sent --
> when mail stops it will be noticed rather quickly.  And as someone else
> pointed out, an email alert may not make it anyway (it probably gets
> routed through MailScanner).
>
> There's also the question of whether mail should stop if ANY of the virus
> scanners are unavailable or only if ALL scanners are unavailable.  I
> don't have a suggestion for that.  If you have only 1 virus scanner
> than both conditions are met so it's obvious what to do there.
>
> -frank

Agreed. (a) seems to make the most sense and hopefully isn't too 
difficult to implement. I think quarantining all the mail would be 
really annoying.

I believe that if people are running more than one virus scanner and one 
stops working, MailScanner should not treat this as a critical error and 
stop processing mail. To me, having more than one virus scanner is just 
like having redundancy of some kind. One failing doesn't mean all 
operations should stop, since messages are still being scanned for 
viruses, just not as well as they might be normally.

mog


More information about the MailScanner mailing list