ClamAV Mailscanner not using clamd

[Anthony Cartmell]

>  this one seems to be eluding me, I've got the settings in
> MailScanner.conf
>  setup, clamav-daemon is installed and a running process based on this:
>
>>  ps ax | grep [c]lamd
>> 4957  ?   Ss      0:06    /usr/sbin/clamd
>
> So I'm looking for some indication that it is being used properly.
>  Any suggestions ?

Heh, I've just had the same problem. In my case I'd forgotten that I'd set  
"Virus Scanning = no" while setting up a new server... doh!

With virus scanning enabled again, "MailScanner --lint" gives me output  
like the following, which shows that clamd found the test virus:

~~~~~~~~~~
Trying to setlogsock(unix)
Read 849 hostnames from the phishing whitelist
Read 5065 hostnames from the phishing blacklist
Config: calling custom init function MailWatchLogging
Started SQL Logging child
Checking version numbers...
Version number in MailScanner.conf (4.74.16) is correct.

Your envelope_sender_header in spam.assassin.prefs.conf is correct.

Checking for SpamAssassin errors (if you use it)...
Using SpamAssassin results cache
Connected to SpamAssassin cache database
SpamAssassin reported no errors.
Using locktype = posix
MailScanner.conf says "Virus Scanners = clamd"
Found these virus scanners installed: clamavmodule, clamd
===========================================================================
Filename Checks: Windows/DOS Executable (1 eicar.com)
Other Checks: Found 1 problems
Virus and Content Scanning: Starting
Clamd::INFECTED:: Eicar-Test-Signature :: ./1/eicar.com
Virus Scanning: Clamd found 2 infections
Infected message 1 came from 10.1.1.1
Virus Scanning: Found 2 viruses
===========================================================================
Virus Scanner test reports:
Clamd said "eicar.com was infected: Eicar-Test-Signature"

If any of your virus scanners (clamavmodule,clamd)
are not listed there, you should check that they are installed correctly
and that MailScanner is finding them correctly via its virus.scanners.conf.
~~~~~~~~~~~~~~~~

Thanks to Jules for including the Eicar testing in the --lint : a really  
useful feature :)

HTH,

Anthony
-- 
www.fonant.com - Quality web sites