connect Amavis to an external ClamAV daemon using TCP

To connect Amavis to an external ClamAV daemon using TCP, update your Amavis configuration (typically in /etc/amavis/conf.d/50-user or /etc/amavisd/amavisd.conf).

1. Update @av_scanners Configuration

Replace or update your @av_scanners array with the following syntax:
@av_scanners = ( ['ClamAV-clamd', &ask_daemon, ["{}/", "clamd:CLAMAV_HOST:3310"], qr/\bOK\(/m, qr/\bFOUND\)/m, qr/^.?: (?!Infected Archive)(.*) FOUND$/m ], );

Replace CLAMAV_HOST with your ClamAV container/server hostname or IP address.

1. Crucial Syntax Rules clamd: scheme prefix: Required so ask_daemon matches the protocol to clamav_clamd_internal. Using tcp: or clamav: will cause Unsupported AV protocol name errors.

"{}/*" placeholder: Passes individual extracted MIME files. Using "{}" passes the directory path, causing Is a directory errors during TCP streaming (zINSTREAM).

Single string endpoint: Formatted as "clamd:HOST:PORT". Passing an array reference like ["HOST", 3310] causes Amavis to misinterpret the host as a local UNIX socket.

1. Restart and Test Restart the Amavis service or container to reload the configuration:

Bash systemctl restart amavis Inject the EICAR test string to verify the scan:

Bash printf "X5O!P%%@AP[4\PZX54(P^)7CC)7}\(EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\)H+H*" | sendmail postmaster@yourdomain.com Check your mail log for a successful block:

Plaintext amavis[...]: (...) Blocked INFECTED (Eicar-Signature) ...