[Mimedefang] When to do Virus checks

[Johan Sleeuwenhoek]

2006/11/30, John Rudd <john at rudd.cc>:
>
> I was thinking about moving the virus check from filter_begin to
> filter_end (I do them in filter_begin, having inherited that from the
> example mimedefang-filter).  My reason is: it seems to me that the
> attachment checks (in filter and filter_multipart) are going to be
> cheaper (in CPU time and elapsed time) than the virus checks, and my
> general principle in organizing my AV/AS checks right now is: cheapest
> checks first, so that as little as possible gets sent to the more
> expensive checks.  If the virus check is more expensive than the
> attachment checks, then the attachment checks should be done first.
>
> Does anyone have any thoughts about whether or not it seems like a good
> or bad idea to move the virus checks to filter_end (before the
> SpamAssassin check)?

I think it is worth the extra CPU time to stop a virus at the earliest
time possible. This makes it less dangerous, since the virus does not
pass all the components of your emailscanning system.