> On Mon, Jul 13, 2009 at 12:01:35PM +0200, Matus UHLAR - fantomas wrote: > > > > On 10.07.09 19:09, Henrik K wrote: > > > When you block botnets directly from MTA (zen, helo checks, greylist etc), > > > possible ClamAV/SA load is already reduced by a huge factor. Personally I > > > only see handful of official ClamAV signatures hitting per 100k hams, so > > > the scanning order wouldn't really matter. > > > > It does, if you receive much of mail. If you don't, you can surely call > > clamav and spamassassin (not spamc) from your .procmailrc as well but I > > still won't recommend that.
On 13.07.09 13:35, Henrik K wrote: > I'm not sure I got your point. Do you mean that running ClamAV before SA is > mandatory for "much of mail"? it means that it's always better to run ClamAV before SA and if someone is receiving much of mail and the system is loaded, it could prevent the system from overloading by preventing SA of scanning viruses. > That's only if you are comfortable blocking directly with all the 3rd > party rules, then it's effective yes.>Personally I don't take the 3rd > party FP chances and I also like SA to learn from those mails. As it was already said, you can run clamav twice (although not elementary to do) with different configurations (wih/without 3rd party rules). -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. If Barbie is so popular, why do you have to buy her friends?
