# connect Amavis to an external ClamAV daemon using TCP

To connect Amavis to an external ClamAV daemon using TCP, update your Amavis configuration (typically in `/etc/amavis/conf.d/50-user` or `/etc/amavisd/amavisd.conf`).

### 1\. Update `@av_scanners` Configuration

Replace or update your `@av_scanners` array with the following syntax:  
@av\_scanners = ( \['ClamAV-clamd', &ask\_daemon, \["{}/*", "clamd:CLAMAV\_HOST:3310"\], qr/\\bOK$/m, qr/\\bFOUND$/m, qr/^.*?: (?!Infected Archive)(.\*) FOUND$/m \], );

Replace CLAMAV\_HOST with your ClamAV container/server hostname or IP address.

2.  Crucial Syntax Rules clamd: scheme prefix: Required so ask\_daemon matches the protocol to clamav\_clamd\_internal. Using tcp: or clamav: will cause Unsupported AV protocol name errors.
    

"{}/\*" placeholder: Passes individual extracted MIME files. Using "{}" passes the directory path, causing Is a directory errors during TCP streaming (zINSTREAM).

Single string endpoint: Formatted as "clamd:HOST:PORT". Passing an array reference like \["HOST", 3310\] causes Amavis to misinterpret the host as a local UNIX socket.

3.  Restart and Test Restart the Amavis service or container to reload the configuration:
    

Bash systemctl restart amavis Inject the EICAR test string to verify the scan:

Bash printf "X5O!P%%@AP\[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H\*" | sendmail postmaster@yourdomain.com Check your mail log for a successful block:

Plaintext amavis\[...\]: (...) Blocked INFECTED (Eicar-Signature) ...