Re: [exim] Reminder: ClamAV 0.95 minimum from 2010-04-15

e.sand+exim-users@??? wrote:
>> Discussion lists, certainly. But I do encourage you to consider the benefits of
>> -announce lists, especially those which, at most, get one mail per week and
>> more often get maybe three mails in a year.
>
> Actually, I do have myself subscribed to a bunch of projects on freshmeat and sourceforge for typical linux programs (did this way back when I decided to make my own distro, so I needed a way to check up on practically everything on a system). I still have those coming my way which keeps me partially in the loop of whats new, but I guess I never subscribed to ClamAV.
>
> In my particular case though, it's not an end of the world situation - I have just my own server to look after these days, and I had actually profiled my email logs a while back and noticed that of the VERY few emails I received which had viruses, they were already being caught by Spamassassin, so I disabled ClamAV - no need to really worry about upgrading it.
>
> Eli.
>
>

Eli,

IMNSHO, that's bass-ackwards.

SA - implemented in an interpreted language, even one that is arguably a very
good fit to the task, but making *seriously* complex tests, requires perhaps
several orders of magnitude more resources than ClamAV's slender compiled binary
performing a more straightforward job. EG - one where the 'heavy lifting' has
been done externally in the signature DB periodically refreshed and w/o Exim
involvement. Or even much delay.

We've always run SA stripped-down to only such tests as cannot be done more
'cheaply' by Exim (or ClamAV) and are having good success a year into the
experiment with dropping SA altogether on one of our servers.

IOW - once you kick the rDNS fail zombots off the teat, perform a few similar
low-load tests, look at an LBL or RBL or two, there just ain't enough 'spam'
left to justify SA's need for CPU cycles.

YMMV,

Bill