Re: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread R. Scott Perry
The best of both worlds approach would be to allow for a switch, SKIPIFFOUND ON. Removing the second scanner isn't a good option as variants can come at any time and both F-Prot and AVG lagged badly on picking up both Mimail.s and MyDoom.b. We will look into adding an option like this.

Re: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread Matt
Scott, During virus outbreaks like this one, having the second scanner not run when the first detects a virus would be a big processing saver. My server was probably averaging about 5 times the normal processing load in the last 3 days, catching a virus on average about 1.5 times a minute. W

RE: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread Keith Johnson
: [EMAIL PROTECTED] Subject: RE: [Declude.Virus] Multi-scanner Question >If they are run in series, then wouldn't it be best to run the next >scanner only if the previous scanner passed? In other words why scan >the email again if it already failed one of the scanners? The logic behi

RE: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread R. Scott Perry
If they are run in series, then wouldn't it be best to run the next scanner only if the previous scanner passed? In other words why scan the email again if it already failed one of the scanners? The logic behind that is the only a small fraction of E-mail contains a virus. Since the majority of

RE: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread Charles Frolick
EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Friday, January 30, 2004 11:15 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.Virus] Multi-scanner Question >Are multiple scanners run in series or concurrently? They are run in series. Since the virus scanners typically use up as close to

Re: [Declude.Virus] Multi-scanner Question

2004-01-30 Thread R. Scott Perry
Are multiple scanners run in series or concurrently? They are run in series. Since the virus scanners typically use up as close to 100% of the CPU time that they are given, if we switched to running them in parallel, an improvement would only be shown on servers with multiple processors. Howe