Clamav failed to scan email with an attachment in email

NethServer Version: 7.6.1810 (final) + all last update
Module: email

I use email+rspamd+antivirus(clamav).
In rspamd, i often see symbols

CLAM_VIRUS_FAIL (0) [failed to scan and retransmits exceed]

With an attachment in email.
What does it mean?

Sorry my English…

Just googled, so the following is only if I understood it correctly. I’m not an expert on this!

Message comes from this function:

The function trys to check upstream-server. If upstream returns err, it trys to contact different upstream for retransmits-1 times. If this doesn’t help, the function returns the message.

Here is something abot to configure upstream server:

Maybe @stephdl can help here?

1 Like

how many time please ?, to test

grep -srni 'CLAM_VIRUS_FAIL' /var/lib/nethserver/vmail/

I tested on my server, for now only two times on 11 years of email :smiley:

EDIT : 5 times

does your server is not powerful enough to run the email stack ?

This is the the clamd service we run

[root@prometheus ~]# systemctl cat clamd\@rspamd
# /usr/lib/systemd/system/clamd@.service
Description = clamd scanner (%i) daemon
Documentation=man:clamd(8) man:clamd.conf(5)
# Check for database existence
# ConditionPathExistsGlob=@DBDIR@/main.{c[vl]d,inc}
# ConditionPathExistsGlob=@DBDIR@/daily.{c[vl]d,inc}
After =

Type = forking
ExecStart = /usr/sbin/clamd -c /etc/clamd.d/%i.conf
Restart = on-failure

# /usr/lib/systemd/system/clamd@rspamd.service.d/nethserver.conf


maybe we could make a timeout a bit longer (not set actually)

i use only nethserver+email+rspamd+clamav
and found 19 times

how many users, does the server is restricte to your usage or for a company ?

127 users

1 Like

would you please test something, add

# Set bytecode timeout in milliseconds.
# Default: 5000
# BytecodeTimeout 1000

maybe we could start by BytecodeTimeout 10000

add this in /etc/clamd.d/rspamd.conf


systemctl restart clamd\@rspamd

you could run like some days, but waiting to see if we could have others errors, please could you dive inside /var/log/maillog looking with the rspamd ID (for example rspamd[26918]: <31e2e3>) of the transaction if you could catch some errors of clamd (all transaction are written inside this logs)

I am sure the answer is inside your logs why clamd failed, please keep us in touch

ok I can reproduce, I have myself these warnings in my maillog.

In fact when it fails, it is reloading its database and it take a long time on my server, probably 10s is not enought, we could try a bit longer or accept to fail to scan

cc @davidep cc @filippo_carletti

May  5 19:46:56 prometheus clamd[4618]: SelfCheck: Database modification detected. Forcing reload.
May  5 19:46:57 prometheus clamd[4618]: Reading databases from /var/lib/clamav
May  5 19:47:35 prometheus clamd[4618]: Database correctly reloaded (6289711 signatures)

each time I reload the database, I have the warning if I receive an email at this moment

1 Like

from this link

we can see:

timeout = 5.0, -- FIXME: this will break task_timeout!
detection_category = "virus",
retransmits = 2,

ok this is what I added in /etc/rspamd/local.d/antivirus.conf (it is a template)

timeout = 15;

then systemctl restart rspamd

on my server, to load the new DB it takes between 15-30 seconds, rspamd attempts two times, so it should be good enough.

after this I can see the new DB loaded in maillog (Database correctly reloaded) but no more CLAM_VIRUS_FAIL

another approach could be to force an action

[root@prometheus ~]# cat /etc/rspamd/local.d/force_actions.conf 
rules {
        action = "soft reject";
        message = "Cannot validate the message now. Try again later";
        expression = "CLAM_VIRUS_FAIL";

then we could find this in header

default: F (soft reject): [-0.76/19.90] [FORCE_ACTION_CLAM_VIRUS_FAIL(1.00){soft reject;}


Do I need to test something?
or do you test it yourself?

yes please, could you check

the rpm to install is

yum install


Thank you very much!
I installed your package.
and so far I do not see the errors “CLAM_VIRUS_FAIL (0) [failed to scan and retransmits exceed]”.
I think I need to test for a few days or a week.

You can simulate the db reloading, check the qa link, send you some emails with attachments and during this you can launch the command each 10s/5s in a terminal of your server.

The pragmatic wait and see is good also

i see new Symblos in rspamd
CLAM_VIRUS_FAIL (0) [failed to scan and retransmits exceed]

and Action soft reject
my mail with attachments


yep this is good, do you have a github account to write in the issue how you tested and what is the output of the log transaction ?

soft reject, means try later please, the smtp will do it accordingly its sender policy

I don’t have github account.
How i tested?
I installed your package and saw the Symbols in rspamd webui.
The only way