[Rspamd-Users] Rspamd clamav integration - Am I overlooking something?

[Steve]

Hi Rspamd users,

I'm trying to configure Rspamd, for the first time, to replace an old 
Amvisd/Spamassassin/clamav system.  I'm aware that clamav does not offer 
the most robust protection against viruses - but, at this stage, my 
intention is to configure Rspamd so as to loose minimal capabilities 
when I retire the Amvisd setup.  Email volumes are low - so I am not 
concerned about bandwidth and clamav.  I know the effectiveness of 
clamav as a virus/malware detection tool are limited - but I would 
prefer to keep this facility working as part of a much broader solution.

I am surprised that I haven't been able to get the rspamd/clamav 
integration to work - despite having read the documentation for the 
Antivirus Module <https://docs.rspamd.com/modules/antivirus/> and 
nagging google for hints.

I have this in my /etc/rspamd/local.d/antivirus.conf :

> clamav {
>   scan_mime_parts = true;
>   symbol = "CLAM_VIRUS";
>   type = "clamav";
>   servers = "/var/run/clamav/clamd.ctl";
>   patterns {
>     JUST_EICAR = '^Eicar-Test-Signature$';
>   }
>   log_clean = true;
> }

The unix-domain socket name for clamd.ctl is valid - and there are both 
read and write permissions for the _rspamd user that runs rspamd. I 
can't see any log messages indicating a problem connecting with clamav. 
  I have "antivirus" specified for debug_modules in 
/etc/rspamd/local.d/logging.conf .

In the rspamd log I see this message sequence (and nothing relevant to 
antivirus or clamav after it):

> Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua; 
> lua_redis.lua:834: use default Redis settings for antivirus
> Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua; 
> lua_util.lua:1370: enable debug for Lua module clamav (antivirus aliased)
> Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua; 
> antivirus.lua:212: added antivirus engine clamav -> CLAM_VIRUS
> Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua; 
> antivirus.lua:367: no category symbols defined for clamav
> Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; cfg; 
> rspamd_init_lua_filters: init lua module antivirus from 
> /usr/share/rspamd/plug>

I assume the antitivirus module is not integrating with clamav over the 
Unix socket because it detected no configured category symbols.  I know 
other anti-virus engines require configuration for *symbols *(plural 
important) but all the documentation and example configuration for 
clamav seem to use the singular *symbol *and "CLAM_VIRUS".

When I look at antivirus.lua:367 - I notice that the log message is 
reached if rule.symbols evaluates false on line 327.  This suggests to 
me that either I need configuration for symbols in 
/etc/rspamd/local.d/antivirus.conf (I'm not sure what syntax would be 
appropriate) or there's a bug in the antivirus module and/or its 
documentation.

I'm using the version 4.1.1-1~0f29274~trixie - on Debian Trixie. When I 
look on Github, antivirus.lua 
<https://github.com/rspamd/rspamd/blame/master/src/plugins/lua/antivirus.lua> 
does not seem to have been updated since the release I'm using. The code 
block from 327-368 is attributed to Vsevolod Stakhov with a commit on 3 
October 2025 - related to a feature extending /MetaDefender/ and 
/VirusTotal/ integration support.

*My questions:*

Does rspamd still support integration with clamav?

Have I misconfigured - or is this a bug/regression in the current rspamd 
release (or the documentation for the antivirus module)?

Is there an easy way to fix configuration and get clamav scanning my 
email attachments using rspamd?

If no one can see my mistake... I could raise an issue on Github. Would 
that be best?

Steve