CLAM

    RPM's won't install onto RH7.3 because of clib version.
    Install gmp-devel rpm (Digital sigs need the static libgmp.a).
    Building the milter.
        Install sendmail-devel rpm.
        Apply patch clamav-0.65-rh73.patch (you can get this for the src rpm).
          (All the patch does is add the Sendail libs in correct order).
        Remove "$(MANS)" from the ^all-am: line because Makefile is screwed
         and can't make the man file for milter;
         also remove the target from the ^install-man: line for same reason.
        Run .configure --enable-milter
        Make and install as usual.
        I don't know how to make clamav-milter run as non-root.
        The socket in the clamav-mitler sysconfig file must match that in
         your sendmail.mc milter call.
    Scp the sysconfig files for clamav-milter and freshclam to /etc/sysconfig.
    Scp clam-enabled-rh-host:/etc/init.d/*clam* yourhost:/etc/init.d.
     But make sure paths are right:  clamav.conf.  */bin/*.
    Make unprivileged clamav user.
    Mkdir /var/run/clamav /var/log/clamav, chown both to clamav.
    chkconfig X on each such init script.
    Looks like the preferred way to run freshclam is as a daemon, so use
     the init script for it and don't use cron.
    clamav.conf:  Set upser to clamav.  Set pid file and log dest.
         Turn on StreamSaveToDisk and ScanMail
    freshclam sysconfig file:  Set log dest.
    (clamd.log gets owned by clamav, but not clamd.log??)

Startup order (which you can see by lsins any rcX.d directory) is
    clamd, freshclam, clamav-milter.

Both local sockets and network sockets work fine because both spamd
server and client(s?) like milter read the same cfg file to see where
to connect up at.
If run with network socket, lock files are produced under 
/var/lock/subsys.


At AA, after Clamav ran for about 12 hours, Sendmail got REALLY slow
responding to FROM commands.
Problem went away by restarting clamav-milter.
ONCE I also had to restart clamd to make problem go away, but usually not.
Doesn't seem to matter if run with local or network clamd socket.