On Fri, 29 Jul 2011 15:08:34 -0400 Adam Moffett <adamli...@plexicomm.net> wrote:
> I've often mused about which should run first, but never did any sort > of testing. Is it pretty much the general consensus that it's less > wasteful for the AV to scan the spam than to have SA scan the malware? It's probably more efficient to have the thing that would block more mail run first. On our installation, for example, ClamAV stops less than 0.1% of all mail (yes, you read that right), so running it first is useless from a performance standpoint since SA would be invoked almost all the time anyway. We don't use the Sane Security signatures. If using them would make Clam block (say) 10% or more of all messages, I'd have to re-evaluate my opinion. Regards, David.
