Re: Bayes & Apache James server

[Jason Bertoch <ja...@i6ix.com>]

On 7/29/2011 3:08 PM, Adam Moffett wrote:
> On 07/29/2011 02:13 PM, Kelson Vibber wrote:
>>> >  Also, to complete the system, I recall there were some AV-mailets 
>>> at the age. If possible use>  them before SA to catch message 
>>> carrying viruses.
>> Absolutely - we've got ClamAV running first, before anything touches 
>> SA, and using some of the SaneSecurity signature sets to catch 
>> additional malware.
> I've often mused about which should run first, but never did any sort 
> of testing.  Is it pretty much the general consensus that it's less 
> wasteful for the AV to scan the spam than to have SA scan the malware?
>
>

It depends on your setup and, more importantly, your ability to feed 
mail back into Bayes.  For my last setup, the filter sat in front of 
customer-hosted servers, which left no easy feed back into Bayes.  As a 
result, I had to use autolearn on a carefully maintained filter.  In my 
case, Bayes performed extraordinarily better when run prior to clam 
(with SaneSecurity) due to seeing the bad mail.  I'd done the opposite 
for some time before testing this, and needed to retrain the database 
more often than I cared to, because it thought everything was ham.  I 
never saw a performance hit on a 1 million/day server, but the Bayes 
accuracy was far better.

$.02

-- 
/Jason