Hi Joerg,
I have been using ClamAV for many years, probably since ClamWall was introduced in Mercury. Detections are very common, diverting these messages to a quarantine directory. I enhance it by including some third party definition files from Sanesecurity. Def updates are timed based on a setting of your choice in a configuration file. The default setting is every 10 minutes which I thought was too often so I set it to update hourly.
One shortcoming of ClamWall/ClamAV is that there isn't a built-in detection notification mechanism. The workaround is a utility called CWscan written by Paul Whelan. When executed, it scans the quarantine directory for new files, creates a .cnm file for each one containing relevant info about the detection, and writes it to a directory (mounted as an added mailbox), then moves the scanned messages to an archive directory. As for overhead, I don't have a sense that it is of significance although I believe my mail volume is a good bit lower than yours. I don't know whether higher volume=noticeable overhead.
Is ClamAV necessary? Probably not, but I think the Sanesecurity defs help keep suspicious messages out of the user mailboxes. False detections occur but are very rare.
You're welcome to email me directly if you care to discuss in more detail.
<p>Hi Joerg,</p><p>I have been using ClamAV for many years, probably since ClamWall was introduced in Mercury.&nbsp; Detections are very common, diverting these messages to a quarantine directory.&nbsp; I enhance it by including some third party definition files from Sanesecurity.&nbsp; Def updates are timed based on a setting of your choice in a configuration file.&nbsp; The default setting is every 10 minutes which I thought was too often so I set it to update hourly.
</p><p>One shortcoming of ClamWall/ClamAV is that there isn't a built-in detection notification mechanism.&nbsp; The workaround is a utility called CWscan written by Paul Whelan.&nbsp; When executed, it scans the quarantine directory for new files, creates a .cnm file for each one containing relevant info about the detection, and writes it to a directory (mounted as an added mailbox), then moves the scanned messages to an archive directory.&nbsp; As for overhead, I don't have a sense that it is of significance although I believe my mail volume is a good bit lower than yours.&nbsp; I don't know whether higher volume=noticeable overhead.
</p><p>Is ClamAV necessary?&nbsp; Probably not, but I think the Sanesecurity defs help keep suspicious messages out of the user mailboxes.&nbsp; False detections occur but are very rare.
</p><p>You're welcome to email me directly if you care to discuss in more detail.
</p>
