Karsten Bräckelmann wrote: > On Fri, 2008-01-25 at 17:54 -0800, Dennis Peterson wrote: >> Karsten Bräckelmann wrote: >> >>> The main purpose was, to keep ClamAV from scanning the entire, possibly >>> large file (err, mail). And maybe even speed it up. It's good practice >>> to bound your REs or wildcards anyway. >>> >>> I wonder, if this indeed would speed up scanning, however small, of >>> large-ish files. Or would the additional constraint actually impose more >>> CPU cycles spent? >> The sigs are full of unbound RE's. That's why scanning mbox mail files is >> pointless. > > Yes, I know. I contributed that fact to the thread a while ago... > > I do realize the ambiguity here -- there is no plural for 'mail'. :) > However, I am talking about a *single* mail. If I would have been > talking about mbox files, I'd have used that term. > > Dennis, thanks for your reply. Just doesn't answer the question, > unfortunately... ;) > > guenther > >
I've been out of town and haven't got caught up on all the world's history. ClamAV's archives on on the list. Bounded (and anchored) RE's always run faster and they're more accurate. What's to lose? dp _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
