[Rspamd-Users] Discarding email detected as viruses by ClamAV

[Steve Siirila]

Thanks for the followup!

We were never able to get this to work without using a ridiculously high
score. We give a score of 100 in metrics.conf and set a discard threshold
of 100 in actions.conf which does work, but is not ideal.

Here's our antivirus.conf:

clamav {
    type = "clamav";
    servers = "/run/clamd.scan/clamd.sock";
    symbol = "CLAMAV";
    max_size = 25000000;
    log_clean = true;
    scan_mime_parts = false;
    scan_local = true;
    scan_authenticated = true;
    scan_ham = true;
    action = "discard";
    message = "Virus found: ${VIRUS}";
}

Here's our metrics.conf:

group "antivirus" {

  symbol "CLAMAV" {
    weight = 100.0;
    description = "Virus detected by ClamAV";
    one_shot = true;
  }

  symbol "CLAMAV_FAIL" {
    weight = 10.0;
    description = "ClamAV scan failed";
  }
}

and our actions.conf:

reject = 15;
add_header = 6;
greylist = 4;
discard = 100;

On Tue, Feb 3, 2026 at 2:01 AM Danjel Jungersen <danjel at jungersen.dk> wrote:

> Hi.
>
> I don't see a response on this one.
>
> Have you made it work?
>
> On 07-01-2026 15:34, Steve Siirila via Users wrote:
>
> Has anyone successfully configured Rspamd to use ClamAV to discard anything
> it detects as a virus?  We can get it to reject such email, but we want it
> silently discarded instead.
>
> In: /etc/rspamd/local.d/antivirus.conf
> I have this:
> clamav {
>  attachments_only = false;
>  symbol = "CLAM_VIRUS";
>  type = "clamav";
>  action = "reject";
>  servers = "/var/run/clamav/clamd.ctl";
>  retransmits = 5;
>  timeout = 60;
> }
>
> If I read this correctly:
> https://docs.rspamd.com/configuration/metrics/
>
> And you have rspamd version 1.9 or above, you should be able to replace
> reject with discard
>
> I hope it works!
>
> :-)
> --
> Med venlig hilsen/Kind regards
> Danjel Jungersen
> Mail: danjel at jungersen.dk
> Mobile: +45 20 42 20 11
>
> Jungersen Grafisk ApS,
> Holsbjergvej 39, DK-2620 Albertslund,
> Denmark.
> Tel: +45 43 64 10 00
>
> WEBSHOP: PRINTLIGHT.DK <https://www.printlight.dk> | WWW.JUNGERSEN.DK
> <https://www.jungersen.dk>
>
> [image: Logo] <https://www.jungersen.dk>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logo_m_reg_125.png
Type: image/png
Size: 24506 bytes
Desc: not available
URL: <https://lists.rspamd.com/pipermail/users/attachments/20260203/5f7a3766/attachment.png>