VSAPI in Exch 5.5 is really limited and can't catch some type of virus, imbedded in the message body itself. VSAPI in 5.5 can only catch attachment and, you won't know who was infected. You need to run both MAPI and VSAPI to protect you. I read some time ago that in Exch 2000 VSAPI would be better integreted.
ESE insert itself just in front of the store. Antigen from Sybari was the first. Now, Scanmail from TrendMicro also support it. We switched from VSAPI/MAPI to ESE when Scanmail 3.8 come out. I now don't have performance problem. -----Message d'origine----- De : Ed Crowley [mailto:curspice@;pacbell.net] Envoy� : 25 octobre, 2002 13:11 � : Exchange Discussions Objet : RE: Exchange 5.5 Anti-Virus implementations VSAPI sort of gets between the client and the server, so if its performance is bad, everyone will notice it. However, VSAPI, at least in theory, will catch everything its patterns are capable of catching. MAPI runs in the background, but can miss viruses if it can't keep up with the load. However, it has less impact on your load because it's secondary. It sounds like your problem is related to either an inefficient virus scanner, an overloaded system, a resource problem (such as insufficient memory or processor), or both. Ed Crowley MCSE+Internet MVP kcCC+I Tech Consultant hp Services Protecting the world from PSTs and Bricked Backups! -----Original Message----- From: [EMAIL PROTECTED] [mailto:bounce-exchange-94760@;ls.swynk.com] On Behalf Of [EMAIL PROTECTED] Sent: Thursday, October 24, 2002 3:38 AM To: Exchange Discussions Subject: Exchange 5.5 Anti-Virus implementations Hello - [NT4 Server SP6a, Exchange enterprise 5.5 SP4] Has anyone used and compared Exchange anti-virus products that employ different scanning methods, e.g. MAPI/VSAPI/ESE? I'm curious about the performance differences between the implementations. We're currently using a VSAPI-based product and the performance is pretty dreadful - loads of archiving/synchronization errors and people with incomplete offline mailbox replicas. The anti-virus software is patched and up-to-date and we've adjusted the "OpenRetryDelay" several times, to no avail. The server hosts about 120 active mailboxes - some pretty big - but the store databases have a dedicated 6-drive, ultra 160 SCSI, raid 5 volume. The transaction logs are on a different volume. PRIV.EDB is currently about 45GB in size and the problem affects every user on the server. I just wondered if there were any outright conclusions that favoured one approach or product over the others. Also, I'd be interested if anyone can confirm that the VSAPI interface builds a single, potentially long queue of attachments to be scanned, introducing a bottleneck ? Thanks, Loftus Greig _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:leave-exchange@;ls.swynk.com Exchange List admin: [EMAIL PROTECTED]
