[Rspamd-Users] clam stopped working somewhere in the past

[Stefan Bauer]

apparmor active? Try to teardown / configure.
Maybe firewall.

Am Mi., 3. Juni 2020 um 13:23 Uhr schrieb R.N.S. via Users <
users at lists.rspamd.com>:

> Hi,
>
> I have no idea why, but for some reason, Rspamd no longer scans mail with
> clamav:
>
> 2020-05-14 15:01:20.50670 #8501(rspamd_proxy) <a0ed63>; clamav;
> clamav.lua:106: clamav: error: IO read error: connection term
> inated; retry IP: 127.0.0.1; retries left: 1
> 2020-05-14 15:01:20.50715 #8501(rspamd_proxy) <a0ed63>; clamav;
> clamav.lua:106: clamav: error: Socket error detected: Connect
> ion refused; retry IP: 127.0.0.1; retries left: 0
> 2020-05-14 15:01:20.50741 #8501(rspamd_proxy) <a0ed63>; lua;
> clamav.lua:119: clamav: failed to scan, maximum retransmits exce
> ed
> 2020-05-14 15:01:20.50753 #8501(rspamd_proxy) <a0ed63>; lua;
> common.lua:107: clamav: result - FAILED with error: "failed to s
> can and retransmits exceed - score: 0"
>
> Rspamd version is 2.5 stable
> ClamAV version is 0.102.2
>
> I have override.d/antivirus.conf:
>
> -----------------------------------------------
> clamav {
>     prefix = "rs_clamav_";
>     scan_mime_parts = true;
>     max_size = 20971520;
>     symbol = "CLAMAV_VIRUS";
>     type = "clamav";
>     log_clean = true;
>     servers = "127.0.0.1:3310";
>     patterns {
>         JUST_EICAR_CLAMAV = "^Eicar-Test-Signature$";
>         SPOOFED_DOMAIN = "^Heuristics\.Phishing\.Email\.SpoofedDomain";
>         SANESECURITY = ".*UNOFFICIAL$";
>     }
>     patterns_fail {
>         CLAM_LIMITS_EXCEEDED = '^Heuristics\.Limits\.Exceeded$';
>     }
>     whitelist = "/etc/rspamd/antivirus.wl";
> }
> -----------------------------------------------
>
> clamav is listening on 3310:
>
> lsof -Pni :3310
> COMMAND  PID   USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
> clamd   8584 clamav    5u  IPv4 117269499      0t0  TCP 127.0.0.1:3310
> (LISTEN)
>
>
> Does someone have an idea, what is going wrong?
>
> Many thanks for any hint in advance
>
> Christian
> --
> Rößner-Network-Solutions
> Karl-Bröger-Str. 10, 36304 Alsfeld
> Fax: +49 6631 78823409, Mobil: +49 171 9905345
> USt-IdNr.: DE225643613, https://roessner.website
> PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5
>
> --
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users
>