> That does not work any more. I have skipped on the whole notification
> stuff, since it confuses (l)users too much.
>
> I had people sending me hate mail ("You sent me a virus !") when Klez
> was using my address. I had local users spending the day with phone
> calls to "sort out" bogus virus alarms.
>
> My conclusion: Do not send automated notifications. Never. To noone :)
From experience I have to agree however it would be nice to have
more than one action possible. Ideally I would like to be able to say:
exiscan_av_action = reject : redirect viruscollector@localhost
which will reject the message and redirect a copy to another address
for investigation purposes.
Actually the ideal ideal, ahem, would be:
exiscan_av_action = reject : save /var/viruses/
which writes the mail to a local file to reduce the loading. I suspect
that there is a way to do this with exim but I don't know how. If
local_scan() is run after the ACLs and before the routing then adding in
a router to redirect wouldn't work...
Just for info we're rolling out exim/exiscan/sophie/sophos across our
new campus hubs. Handling a couple of million emails a week and expect
to block approx 700 viruses a day. Thanks for the excellent software guys.
Mike
--
-----Plain text only please - attachments stripped on arrival.------
Copyright 2002 Mike Richardson, Room G98, Manchester Computing
University of Manchester, M13 9PL doctor@??? Int: 56009
Left through main doors. Right then left at end of corridor.
First door on left. URL http://kira.mcc.ac.uk/ Ext: 0161 275 6009
--------------------------------------------------------------------
"If I want your opinion, I'll **** it out of you!" - Chuck Norris
"If anything happens to my daughter I have a ** and ******" Clueless
