1

Currently running Postfix, Amavis, Spamassassin, and ClamAV spam filter which sends to on site Exchange server. Running on Ubuntu Server 16.04 CLI. Everything works and sends mail to Exchange server no problem, Spamassassin and Amavis work and pickup/block spam. But I can't get Clam to scan for viruses in the e-mail coming through postfix, I see nothing in mail.log about it scanning. The EICAR test file and ClamAV test files go right through the filter.

The only thing related to clam in syslog is: (!)ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamav/clamd.ctl, retrying (2).

I can post logs if needed.

Improve this question
7
  • Is it amavis or clamav?
    – George Udosen
    Dec 16, 2019 at 18:41
  • Clam is not scanning, I worded it a bit weird.
    – rets34
    Dec 16, 2019 at 19:21
  • Is clam running?
    – George Udosen
    Dec 16, 2019 at 19:33
  • clamav-daemon and clamav-freshclam are both running.
    – rets34
    Dec 17, 2019 at 15:20
  • Are you scanning manually? As clam always complains when you do that!
    – George Udosen
    Dec 17, 2019 at 15:36

1 Answer 1

Reset to default
0

From the official wikipages for clamav to set clamav up we have two modes:

  1. Manual mode and is setup and used accordingly

    • Install:

      sudo apt install clamav clamtk

    • Usage:

      sudo clamscan [options] [target file or directory]

  2. Daemon mode and is setup and used accordingly

    • Install:

      sudo apt install clamav-daemon

    • Usage: 

      sudo clamdscan [options] [target file or directory]

Information from wiki

Run ClamAV as a Daemon

Install clamav-daemon. You can then use clamdscan where you would previously have used clamscan. Lots of programs, especially e-mail servers, can connect to a ClamAV daemon. This speeds up virus scanning as the program is always in memory.

The clamav-daemon package creates a 'clamav' user; in order to allow ClamAV to scan system files, such as your mail spool, you can add clamav to the group that owns the files.

Let ClamAV listen for Incoming Scans

There are cases where you may want ClamAV daemon to act as a scanner for other systems, so you don't have to run everything locally on the system.

To do this, you simply have to modify the clamd.conf file and add TCPSocket PORTNUMBER and TCPAddr IPADDRESS arguments to the clamd.conf file and reload the daemon. The daemon will then accept connections to it via the IP address and Port combination you specify.

Check to find if Clamscan is running

Look for it in the processt list, or use this handy shortcut: ps ax | grep [c]lamd

Improve this answer
1
  • So the TCPSocket and TCPAddr would match what Amavis is sending to spamassassin? EX: 127.0.0.1:10025. Currently under /etc/amavis/conf.d/15-av_scanners; there is no socket under the Clam-AV section. However it does say match socket name (LocalSocket) in clamav.conf to the socket name in # this entry; when running chrooted one may prefer socket "$MYHOME/clamd.
    – rets34
    Dec 19, 2019 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .