[Mimedefang] Perl Mail::ClamAV

[John Rudd]

So, I got around to writing some test code for this, and running it.

I set up 3 directories, hamdir, spamdir, virdir, each of which is a 
mimedefang message directory (contains COMMANDS, HEADERS, and 
INPUTMSG).  The message in hamdir is actually a message from this 
mailing list, from earlier today.  Spamdir is a spam I got yesterday.  
Virdir is a message which contains the Eicar-Test-Signature virus.

My code:
    a) uses open2 to communicate with mimedefang.pl -server
    b) does system("date") and records the start time.
    c) runs a scan on each directory 333 times (when loop variable
       %3 == 0, scan hamdir, when %3 == 1, scan spamdir, when %3 == 2,
       scan virdir; loop variable goes from 1 to 999).
    d) records the end time, does system("date"), and prints end - start.

I am running it once with a filter that uses the code I posted last 
time, and once with a filter that is exactly the same, except that it 
invokes clamd.

While I may not have placed the system(date) calls optimally, and a few 
other things like that, I think the fact that both will be called in 
exactly the same manner makes up for this.

Output from using Mail::ClamAV :

Tue Sep 20 06:31:46 PDT 2005
Tue Sep 20 06:42:53 PDT 2005
delta = 667

(so, eleven minutes and seven seconds)

Output from using clamd:

Tue Sep 20 06:48:18 PDT 2005
Tue Sep 20 06:49:23 PDT 2005
delta = 65


Um.  Holy moly.  Second pass had 70 seconds for clamd, and 629 seconds 
for Mail::ClamAV.  I don't think it's a fluke.  Still, it was a fun 
exercise to see if it would work.  (the advantage to Mail::ClamAV is 
that you don't need to depend upon any other process, for example, if 
clamd crashes or something; but the obvious cost is: scanning is 10 
times slower).


I would be happy to share my test code with anyone who wants to do this 
for themselves, but since I pretty much just confirmed everyone's 
expectations here, I doubt that will happen.  :-)

I expect most of the challenge will come from posting the same results 
on the mailscanner mailing list (who all believe that Mail::ClamAV is 
the fastest way to go).