[Rspamd-Users] Rspamd clamav integration - Am I overlooking something?

[Steve Siirila]

Hi Steve,

We recently switched from
Amavis/Spamassassin/ClamAV/OpenDKIM/OpenDMARC/Postgrey to Rspamd/ClamAV and
it has proven a worthwhile effort and resulted in less maintenance. Not to
mention it got us away from:

   1. building and managing our own OpenDMARC instance (because EPEL did
   not compile it w/SPF support properly),
   2. file descriptor leaks in OpenDKIM requiring twice daily restarts,
   3. occasional data corruption in Postgrey requiring detection and
   automatic restarts

Here is our antivirus.conf file:

# /etc/rspamd/local.d/antivirus.conf

# Configure the clamav scanner
clamav {

  # Type of scanner: "clamav", "fprot", "sophos" or "savapi"
  type = "clamav";

  # Servers to query or a path to the unix socket
  servers = "/run/clamd.scan/clamd.sock";

  # Symbol to add (add it to metric if you want a non-zero weight)
  symbol = "CLAMAV";

  # Maximum file size to scan (25MB)
  max_size = 10485760;

  # Log when messages are clean (default: false to reduce noise)
  log_clean = true;

  # Transfer the complete email message (not just attachments) to the AV
scanner
  scan_mime_parts = false;

  # Scan messages originating from local networks? (default is false)
  scan_local = true;

  # Scan messages from authenticated users? (default is false)
  scan_authenticated = true;

  # Scan messages that are classified as non-spam (ham)? (default is false)
  scan_ham = true;

  # Add this line to force rejection immediately
  action = "discard";

  # Optional: Customize the bounce message the sender sees
  message = "Virus found: ${VIRUS}";
}

On Mon, Jul 20, 2026 at 10:05 AM Steve <sjh_rspamd at shic.co.uk> wrote:

> Hi Rspamd users,
>
> I'm trying to configure Rspamd, for the first time, to replace an old
> Amvisd/Spamassassin/clamav system.  I'm aware that clamav does not offer
> the most robust protection against viruses - but, at this stage, my
> intention is to configure Rspamd so as to loose minimal capabilities
> when I retire the Amvisd setup.  Email volumes are low - so I am not
> concerned about bandwidth and clamav.  I know the effectiveness of
> clamav as a virus/malware detection tool are limited - but I would
> prefer to keep this facility working as part of a much broader solution.
>
> I am surprised that I haven't been able to get the rspamd/clamav
> integration to work - despite having read the documentation for the
> Antivirus Module <https://docs.rspamd.com/modules/antivirus/> and
> nagging google for hints.
>
> I have this in my /etc/rspamd/local.d/antivirus.conf :
>
> > clamav {
> >   scan_mime_parts = true;
> >   symbol = "CLAM_VIRUS";
> >   type = "clamav";
> >   servers = "/var/run/clamav/clamd.ctl";
> >   patterns {
> >     JUST_EICAR = '^Eicar-Test-Signature$';
> >   }
> >   log_clean = true;
> > }
>
> The unix-domain socket name for clamd.ctl is valid - and there are both
> read and write permissions for the _rspamd user that runs rspamd. I
> can't see any log messages indicating a problem connecting with clamav.
>   I have "antivirus" specified for debug_modules in
> /etc/rspamd/local.d/logging.conf .
>
> In the rspamd log I see this message sequence (and nothing relevant to
> antivirus or clamav after it):
>
> > Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua;
> > lua_redis.lua:834: use default Redis settings for antivirus
> > Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua;
> > lua_util.lua:1370: enable debug for Lua module clamav (antivirus aliased)
> > Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua;
> > antivirus.lua:212: added antivirus engine clamav -> CLAM_VIRUS
> > Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; lua;
> > antivirus.lua:367: no category symbols defined for clamav
> > Jul 20 15:13:28 server rspamd[14883]: <qpgdgu>; cfg;
> > rspamd_init_lua_filters: init lua module antivirus from
> > /usr/share/rspamd/plug>
>
> I assume the antitivirus module is not integrating with clamav over the
> Unix socket because it detected no configured category symbols.  I know
> other anti-virus engines require configuration for *symbols *(plural
> important) but all the documentation and example configuration for
> clamav seem to use the singular *symbol *and "CLAM_VIRUS".
>
> When I look at antivirus.lua:367 - I notice that the log message is
> reached if rule.symbols evaluates false on line 327.  This suggests to
> me that either I need configuration for symbols in
> /etc/rspamd/local.d/antivirus.conf (I'm not sure what syntax would be
> appropriate) or there's a bug in the antivirus module and/or its
> documentation.
>
> I'm using the version 4.1.1-1~0f29274~trixie - on Debian Trixie. When I
> look on Github, antivirus.lua
> <
> https://github.com/rspamd/rspamd/blame/master/src/plugins/lua/antivirus.lua>
>
> does not seem to have been updated since the release I'm using. The code
> block from 327-368 is attributed to Vsevolod Stakhov with a commit on 3
> October 2025 - related to a feature extending /MetaDefender/ and
> /VirusTotal/ integration support.
>
> *My questions:*
>
> Does rspamd still support integration with clamav?
>
> Have I misconfigured - or is this a bug/regression in the current rspamd
> release (or the documentation for the antivirus module)?
>
> Is there an easy way to fix configuration and get clamav scanning my
> email attachments using rspamd?
>
> If no one can see my mistake... I could raise an issue on Github. Would
> that be best?
>
> Steve
>
>
> --
> Users mailing list
> Users at lists.rspamd.com
> https://lists.rspamd.com/mailman/listinfo/users
>