On Sun, 24 Mar 2002 at 18:25, Brian Baquiran wrote:
> I guess it depends on what antivirus scanner you're using Trend Micro's
> Interscan (I think that's what it's called) runs in front of your actual
> SMTP server and reads mail as it goes through.
I completely agree with Brian here (of course, when it comes to mail, I'd
be stupid to go against him, hehehe). If you use the AMaViS +
filesweeping-antivirus-type (Sophos Sweep or McAfee's uvscan, to name a
few), you go through steps like this for every message that comes in to be
scanned:
1. AMaViS is loaded up, unless you're using AMaViSd, which is a resident
daemon. In the case of AMaViS-perl, this includes whatever overhead is
part of loading Perl.
2. AMaViS will extract the attachment portion of the message. Plug in the
overhead of loading that decoder.
3. AMaViS will fire up an instance of your filesweeping antivirus.
4. Based on this, AMaViS will either send the "certified" message off, or
will quarantine it and send the administrator a notification.
On the contrary using one of the more expensive anti-virus programs
designed for interaction with MTAs, like TrendMicro's Interscan or
Kaspersky's antivirus to name a few, you have the antivirus daemon
resident, interacting with your MTA directly. You cut out a lot of "firing
up", which is expensive. So this should significantly bring down your
overhead.
But there's still extra overhead incurred in the scanning. If you really
really really need the speed, or handle too much mail, then you probably
want to have the scanning delegated to your users, instead.
--> Jijo
--
Federico Sevilla III :: [EMAIL PROTECTED]
Network Administrator :: The Leather Collection, Inc.
GnuPG Key: http://jijo.leathercollection.ph/jijo.gpg
_
Philippine Linux Users Group. Web site and archives at http://plug.linux.org.ph
To leave: send "unsubscribe" in the body to [EMAIL PROTECTED]
To subscribe to the Linux Newbies' List: send "subscribe" in the body to
[EMAIL PROTECTED]
