Jan-Pieter Cornet wrote: > On Mon, Jun 18, 2007 at 09:39:23AM -0400, Christopher X. Candreva wrote: >> On Mon, 18 Jun 2007, Peter Boosten wrote: >> >>> I had some problems running clamd on one of the machines a long time >>> ago, and with mimedefang running clamscan is the second option (which >>> had worked until sometime ago). So I configured mimedefang for clamscan. >> Maybe it's time to ask the mimedefang people to either remove the clamscam >> option, or put a big "NOT FOR PRODUCTION - FOR TESTING ONLY" on it. > > clamscan has a purpose. As others have also said - YMMV. A very lightly > loaded mailserver (~100 msgs/day) shouldn't have a lot of problems with > clamscan. At least not with the 0.88.x version. >
That, or mail servers that scan their email in bulk batches (like those using mailscanner), where the latency of starting clamscan is MUCH smaller than the latency in going through clamd (I've timed both under mailscanner and mimedefang; under mimedefang, using clamd is a HUGE win, as everyone here expects ... under mailscanner, using clamd is a HUGE loss). Though, the fastest method, for mailscanner, is using the ClamAV perl module for directly processing the messages. This wasn't much of a win under mimedefang though. So the real answer here is, as with any non-trivial discussion: "it depends". It depends on what you're doing, and how you're doing it. Batching: look toward clamscan or the ClamAV perl module and away from clamd. Interactive/live (such as a milter): look toward clamd. Ultimately, if it _REALLY_ matters to you, don't listen to other people's dogma, actually develop a test suite to figure out which one is truly faster or slower for your situation. _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
