[Mimedefang] compare mimedefang to mailscanner

[David F. Skoll]

John Rudd wrote:

> [...] This actually far outweighs the IO bottleneck of clamd's
> socket.

Hardly any data flows over clamd's socket.  MIMEDefang just sends the
command:

	SCAN /path/to/filename

and clamd reads the file or files to scan itself.

General comments:

1) Disk I/O:  MIMEDefang will use less disk I/O than Mailscanner because
you're not queueing every mail message twice.  In fact, if you have a modern
version of Sendmail with SuperSafe set to PostMilter and MIMEDefang rejects
or tempfails a message, that queue file won't be sync'd to disk.

2) CPU: MIMEDefang and Mailscanner probably use similar amounts of CPU time.
SpamAssassin and virus-scanners are pigs, no matter how you look at it. :-)

3) Overload: If you are CPU-bound, Mailscanner will handle overload
better than MIMEDefang, because there are no "hard" constraints on how
long it's allowed to take.  During temporary overloads, Mailscanner will just
let your queues grow, while MIMEDefang will tempfail mail (and make things
worse because of all the retries.)

If you are I/O bound, then Mailscanner will probably be worse than MIMEDefang
because of the extra queue I/O.

Regards,

David.