[Mimedefang] log which virusscanner found a virus

[Mack]

try calling the message_contains_virus_XXXXXXXX for each virus scanner you
have
eg
with filescan and sophos use
my $msgHasVirus=0;
my $msgVirusName="";
my($lclscanneronecode, $lclscanneronecategory, $lclscanneroneaction) =
message_contains_virus_filescan()
if ($lclscanneronecategory eq "virus")) {
	$msgHasVirus=1;
	$msgVirusName=$VirusName;
}
if ($msgHasVirus==0)
	 my($lclscannertwocode, $lclscannertwocategory, $lclscannertwoaction) =
message_contains_virus_sophos()
	if ($lclscannertwocategoryeq "virus")) {
		$msgHasVirus=1;
		$msgVirusName=$VirusName;
	}
}


-----Original Message-----
From: mimedefang-bounces at lists.roaringpenguin.com
[mailto:mimedefang-bounces at lists.roaringpenguin.com]On Behalf Of
Cormack, Ken
Sent: 23 June 2005 19:18
To: 'mimedefang at lists.roaringpenguin.com'
Subject: RE: [Mimedefang] log which virusscanner found a virus


-----Original Message-----
From: Matthew.van.Eerde at hbinc.com [mailto:Matthew.van.Eerde at hbinc.com]

> Possible solutions to more fairly treat each scanner:
> * randomize the order that message_contains_virus calls scanners
> * call all scanners for all messages - even if the first scanner found a
virus, call the others - and log all "find"s for each message_contains_virus
call

I have no interest in randomizing the order in which my different scanners
run.  My concern was to use the fastest scanners first (those that are
already memory resident) before calling any externally-loaded binaries.  As
shown, I am better able to justify to management the effectiveness of the
free scanners by showing a lower ROI for their investment in a commercial
scanner (all the while, imposing a lighter load on my systems, and yet still
giving management the "warm-fuzzy" that they get from running a
commercially-supported product - something they seem to find necessary in
this day of SCO lawsuits and legal shyness with regard to Open Source in
general.)

Ken
_______________________________________________
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list
MIMEDefang at lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

This Email Has Been Anti-Virus Scanned