> I was looking at trying to minimise the load imposed by my system filter. It seems
> to me that any message carrying a virus or worm would be very unlikely to have a
> message_body_size less that several kilobytes. So, placing
>
> if $message_body_size is below <some-size>
> then
> finish
> endif
>
> before any virus/worm checking would speed things up for most messages. The
> question is: what would be a sensible value for <some-size>? Very few plain text
> messages seem to be over 5K, looking at the ones I receive, but could a virus/worm
> be so small?
I do something similar in part of my filter. I use 10K. I think most are
going to be quite large, considering they are likely MIME encoded (which
greatly increases the size). But I suppose it's possible for there to be
smaller ones out there.
But generally I find Exim's filtering to be quite quick. My server processes
50,000 to 100,000 messages a day and every one of those passes through a
filter that currently contains 200 rules, mostly regex matches (checks for
worms and viruses, scores potential spam, etc.) Server load hovers around
0.30 (FreeBSD, Pentium III 400MHz) with the odd "spike" to 1.0 or so.
Mark
