On Mon, Jul 13, 2009 at 12:01:35PM +0200, Matus UHLAR - fantomas wrote: > > On 10.07.09 19:09, Henrik K wrote: > > When you block botnets directly from MTA (zen, helo checks, greylist etc), > > possible ClamAV/SA load is already reduced by a huge factor. Personally I > > only see handful of official ClamAV signatures hitting per 100k hams, so > > the scanning order wouldn't really matter. > > It does, if you receive much of mail. If you don't, you can surely call > clamav and spamassassin (not spamc) from your .procmailrc as well but I > still won't recommend that.
I'm not sure I got your point. Do you mean that running ClamAV before SA is mandatory for "much of mail"? That's only if you are comfortable blocking directly with all the 3rd party rules, then it's effective yes. Personally I don't take the 3rd party FP chances and I also like SA to learn from those mails. The word "order" might be a little misleading here. It just comes down to whether you want to block with ClamAV alone, or use ClamAV/SA together. Similar thread here: http://marc.info/?t=124139089800002
