1

Currently running Postfix, Amavis, Spamassassin, and ClamAV spam filter which sends to on site Exchange server. Running on Ubuntu Server 16.04 CLI. Everything works and sends mail to Exchange server no problem, Spamassassin and Amavis work and pickup/block spam. But I can't get Clam to scan for viruses in the e-mail coming through postfix, I see nothing in mail.log about it scanning. The EICAR test file and ClamAV test files go right through the filter.

The only thing related to clam in syslog is: (!)ClamAV-clamd: All attempts (1) failed connecting to /var/run/clamav/clamd.ctl, retrying (2).

I can post logs if needed.

  • Is it amavis or clamav? – George Udosen Dec 16 '19 at 18:41
  • Clam is not scanning, I worded it a bit weird. – rets34 Dec 16 '19 at 19:21
  • Is clam running? – George Udosen Dec 16 '19 at 19:33
  • clamav-daemon and clamav-freshclam are both running. – rets34 Dec 17 '19 at 15:20
  • Are you scanning manually? As clam always complains when you do that! – George Udosen Dec 17 '19 at 15:36
0

From the official wikipages for clamav to set clamav up we have two modes:

  1. Manual mode and is setup and used accordingly

    • Install:

      sudo apt install clamav clamtk
      
    • Usage:

      sudo clamscan [options] [target file or directory]
      
  2. Daemon mode and is setup and used accordingly

    • Install:

      sudo apt install clamav-daemon
      
    • Usage:

      sudo clamdscan [options] [target file or directory]
      

Information from wiki

Run ClamAV as a Daemon

Install clamav-daemon. You can then use clamdscan where you would previously have used clamscan. Lots of programs, especially e-mail servers, can connect to a ClamAV daemon. This speeds up virus scanning as the program is always in memory.

The clamav-daemon package creates a 'clamav' user; in order to allow ClamAV to scan system files, such as your mail spool, you can add clamav to the group that owns the files.

Let ClamAV listen for Incoming Scans

There are cases where you may want ClamAV daemon to act as a scanner for other systems, so you don't have to run everything locally on the system.

To do this, you simply have to modify the clamd.conf file and add TCPSocket PORTNUMBER and TCPAddr IPADDRESS arguments to the clamd.conf file and reload the daemon. The daemon will then accept connections to it via the IP address and Port combination you specify.

Check to find if Clamscan is running

Look for it in the processt list, or use this handy shortcut: ps ax | grep [c]lamd

  • So the TCPSocket and TCPAddr would match what Amavis is sending to spamassassin? EX: 127.0.0.1:10025. Currently under /etc/amavis/conf.d/15-av_scanners; there is no socket under the Clam-AV section. However it does say match socket name (LocalSocket) in clamav.conf to the socket name in # this entry; when running chrooted one may prefer socket "$MYHOME/clamd. – rets34 Dec 19 '19 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.