[Mimedefang] Re: MimeDefang vs clamav

Cor Bosman cor at xs4all.nl
Wed Aug 4 18:10:59 EDT 2004


> > A trawl of the list archives would have provided you with the answer to
> > this - see in particular
> > http://lists.roaringpenguin.com/pipermail/mimedefang/2004-August/023645.html
> 
> Actually, I did peruse the archives - for a ways back...
> 
> Remember, my original said I was running SA 3.0pre2.
> 
> For giggles, I verified that the newer code does not have the same
> exposure.  Besides which, since I'm using the (Debian) supplied
> mimedefang-filter (which is the suggested windows version) -
> spamassassin is called *after* the virus scanners.
> 
> Now, to me, it makes sense to do the spam check first - as I'd expect
> it to be the cheaper of the options... but I'd like to get what I've
> already got in working shape before I embark on the eternal quest to
> improve thing :)

I would do the virus checks first. We have timing information in our
mimedefang-filter. We use 2 virus scanners, which take 0.001 seconds a
piece to finish (yes, around a thousandth of a second). We do about
a dozen DNS blocklist tests, which take a total of 0.005 seconds on average.
We do run local mirrors of all blocklists, but still. Then we run SA,
which takes anywhere from 0.1 seconds to 1 second (once in a while even
several seconds, which is usually a DNS timeout issue). 

Needless to say the impact of virus scanning and DNS blocklist lookups is
virtually non-existant compared to SA. So we definately do SA last.

Cor



More information about the MIMEDefang mailing list