> -----Original Message----- > From: David F. Skoll [mailto:d...@roaringpenguin.com] > > It's probably more efficient to have the thing that would block more mail run > first. On our installation, for example, ClamAV stops less than 0.1% of all > mail > (yes, you read that right), so running it first is useless from a performance > standpoint since SA would be invoked almost all the time anyway.
Depends on the requirements. In our case, we're blocking viruses but tagging spam for later, so it's slightly more efficient to do the virus scan first. Even if it blocks <1%, it's still greater than zero. > We don't use the Sane Security signatures. If using them would make Clam > block (say) 10% or more of all messages, I'd have to re-evaluate my opinion. I wish I could remember the stats from my old job. We had a system that started with IP block lists, then ClamAV with a bunch of the Sane Security spam signatures, then SpamAssassin, all tied together with MIMEDefang. (Thank you, BTW - that piece of software gave me so much flexibility in our scanning!) I had MD sort out the virus hits vs. the spam hits from Clam and decide what got discarded, what got blocked, and what got sent along to SA. I seem to remember it being worth it, but I just can't remember the numbers. Kelson Vibber TollFreeForwarding.com, Development
