Re: [exim] Reminder: ClamAV 0.95 minimum from 2010-04-15

> IMNSHO, that's bass-ackwards.

Quite possibly - and I agree, but I am currently "lazy", thus removing ClamAV since it had fewer "hits" than SA does in my logs is the most logical choice for me (in terms of least work required) at the moment. I would rejoice at the ability to remove SA from my system however, as the mere thought of depending on a Perl program with hundreds of uncompiled RE's makes my boy-bits hide.

> SA - implemented in an interpreted language, even one that is arguably a
> very good fit to the task, but making *seriously* complex tests, requires
> perhaps several orders of magnitude more resources than ClamAV's slender
> compiled binary performing a more straightforward job.

I would have thought so too - and perhaps this is maybe just my config for ClamAV, but I found it to appear to be using more cpu power than SA was when scanning messages... at least I think that's what I remember (might have been memory - but I'm fairly sure it was using more of at least one of the two than SA was). In either case however, I would ultimately really prefer to have Exim running alone - not really requiring the aid of any 3rd party programs to perform message scanning. I haven't had the time or opportunity however to do anything more than think of how nice it would be.

> We've always run SA stripped-down to only such tests as cannot be done
> more 'cheaply' by Exim (or ClamAV) and are having good success a year into
> the experiment with dropping SA altogether on one of our servers.

That statement is extremely intriguing. I would be interested (if it's not a company secret) in learning what measures you take within Exim's config to block out most of your unwanted email. As I stated just earlier - if I could ultimately remove my last dependency of SA from Exim, I would be a happy man.

Eli.