Bart Schaefer:
what I'd like to do is cache a signature (the Message-Id for
purposes of example) when the message is first recognized as a virus,
and only run the scanner on subsequent messages where the signature
does not already appear in the cache.
"formail -D" is *almost* the right thing for this. The trouble is
that when you run it, it adds the message-id to the cache as a side
effect when it is not already there. I need some way to test for the
presence of the message-id in the cache *without* adding it, so that I
can *later* add it if and only if the scanner identifies a virus/worm.
My first try:
1. create a copy of the viral-MID-cache
2.a. if MID was already in copy-of-viral-MID-cache, destroy copy
cache, {...}, break.
b. else just destroy (the now dirty) copy-cache
3. scan for virus
4. if viral, add MID to (real) the viral-MID-cache
The copy could have the PID in the filename. Or use a lock, in that case
you don't need to always create/destroy the copy, though it will stil
occur for most of the messages.
--
Grtz, Ruud
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail