[Rspamd-Users] "soft reject" and "clamav: failed to scan, maximum retransmits exceed"

[G.W. Haywood]

Hi there,

On Tue, 5 Mar 2024, Andreas wrote:

> ...
> 2024-03-05 10:26:41 #46897(rspamd_proxy) <f77b91>; oletools; oletools.lua:111:
> oletools: error: Socket error detected: Verbindungsaufbau abgelehnt; retry IP:
> ...

Has this all worked for you in the past, or is it a new installation?

"Connection rejected" likely means either that the clamd daemon is not running
(and so no connection to the daemon can be made) or your configuration is broken
(in which case the connection attempts are e.g. being made to the wrong socket).
It's possible that you have not arranged appropriate permissions.

> ... I set timeout=20 in /etc/rspamd/local.d/antivirus.conf.

Although I would not expect "Connection rejected" to be the message
which you see when a connection is timed out, in my experience twenty
seconds is very optimistic for ClamAV.  I've seen it take minutes to
scan a PDF.  Obviously this will depend on the performance of (the
machine providing) your scanning process, and what you send to it.

Below are the sizes and approximate ClamAV scanning times of those
messages which arrived here in March and took longer than 20 seconds
to scan.  The scanner is an 8Gbyte Pi4b dedicated to scanning.

   bytes  seconds
   69268  20 - 80
  158175  25 - 33
  187887  33
  872245 140
1055157 142

We see very few messages much larger than this.  They are rejected.

-- 

73,
Ged.