[Mimedefang] compare mimedefang to mailscanner

[John Rudd]

Kenneth Irving wrote:
> I've found Sendmail+MIMEDefang+clamd+spamd a very efficient combination.
> Tried Postfix+MailScanner+clamscan in another computer and it's very slow,
> because Mailscanner doesn't work as a deamon, and doesn't use Clam as a
> deamon either, but relies on running clamscan for every email. The overall
> result is extremely slow.
> 

I forgot to respond to this part:

This is entirely what I was talking about with "economy of scale". With 
MailScanner, if you're scanning messages in such small batches, and so 
infrequently, that you're spending more time with the clamscan 
start-up/initialization overhead, then it will seem like MailScanner is 
slow.

On the otherhand, if you're scanning 100's of messages per minute, in 
100 message batches, then the start-up overhead of clamscan or sweep is 
so insignificant compared to the actual scanning cost, that you get a 
HUGE benefit from this economy of scale.  This actually far outweighs 
the IO bottleneck of clamd's socket.  MailScanner doesn't have any 
support for clamd exactly because clamd would slow down MailScanner in a 
BIG way.

(a few years back I tried to do a comparison between 
MailScanner+clamav_perl_module and MIMEDefang+clamd to see if either 
could be improved by the other ... and I couldn't -- each of them is 
going in such a different IO model that you can't really imply something 
about one's model based on your experiences with the other model... the 
only answer is: MailScanner is fastest with the perl ClamAV module, and 
2nd fastest with clamscan ... but clamd is a significant liability with 
MailScanner; meanwhile, MIMEDefang is _exactly_ the opposite -- using 
clamscan with MIMEDefang causes a significant slowdown because you pay 
the start-up overhead of clamscan with every message ; using the 
experience of one to try to speed up the other will just lead you to 
headaches)