clamav: failed to scan, maximum retransmits exceed

posixaz

Hello,after last update(2022-09a) getting below logs on my rspamd,
runing updating docker on debian11 with last updates,

Is any parameter for adjustment to resolve this issue?

2022-10-03 11:02:09 #42(normal) <6cce70>; lua; clamav.lua:119: clamav: failed to scan, maximum retransmits exceed
2022-10-03 11:02:21 #42(normal) <99e7ad>; lua; clamav.lua:119: clamav: failed to scan, maximum retransmits exceed
2022-10-03 13:42:10 #42(normal) <fd463f>; lua; clamav.lua:119: clamav: failed to scan, maximum retransmits exceed

Hafiz.

aaronsmith

I see those even under 2022-08, most likely you have clamAV disabled in your configuration?

mailcow-dockerized# grep SKIP_CLAMD mailcow.conf
SKIP_CLAMD=y

Unless if your system has 2.5+ GB of RAM, the installation process advises to disable ClamAV to avoid potential out-of-memory failures.

posixaz

Hello aaronsmith,thank you for quick response.
No,clamd activated,and Debian11 on KVM has sufficient memory(8GB).

aaronsmith

Understood, any chance you disabled docker’s firewall and therefore have traffic between containers getting blocked/dropped?

https://docs.docker.com/network/iptables/

posixaz

aaronsmith
Actually rspamd has communication with clamd,clamd working and communicating with rspamd.

Tue Oct 4 10:15:55 2022 -> instream(172.22.1.12@41768): Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL(6a15fb0d27502366d5c8aee412d24d1b:351899) FOUND
Tue Oct 4 10:20:02 2022 -> instream(172.22.1.12@55714): Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL(2e724479d2e914b37f347e31444f5834:351903) FOUND
Tue Oct 4 10:26:39 2022 -> instream(172.22.1.12@36228): Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL(403266308475a7c70a7ae37ce4119eac:351925) FOUND

But sometimes getting errrors below;

2022-10-04 09:41:53 #42(normal) <0c9707>; lua; clamav.lua:119: clamav: failed to scan, maximum retransmits exceed

I’m wondering any tuneable parameter in clamd or in rspamd to adjust?

[unknown]
“/docker-ipv6nat-com…” 38 hours ago Up 38 hours mailcowdockerized-ipv6nat-mailcow-1
“python3 -u /server.…” 38 hours ago Up 38 hours mailcowdockerized-netfilter-mailcow-1
“/sbin/tini -g – /s…” 38 hours ago Up 38 hours mailcowdockerized-acme-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 38 hours mailcowdockerized-rspamd-mailcow-1
“/usr/bin/ofelia dae…” 38 hours ago Up 38 hours mailcowdockerized-ofelia-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp mailcowdockerized-nginx-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:110->110/tcp, :::110->110/tcp, 0.0.0.0:143->143/tcp, :::143->143/tcp, 0.0.0.0:993->993/tcp, :::993->993/tcp, 0.0.0.0:995->995/tcp, :::995->995/tcp, 0.0.0.0:4190->4190/tcp, :::4190->4190/tcp, 127.0.0.1:19991->12345/tcp mailcowdockerized-dovecot-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:25->25/tcp, :::25->25/tcp, 0.0.0.0:465->465/tcp, :::465->465/tcp, 0.0.0.0:587->587/tcp, :::587->587/tcp, 588/tcp mailcowdockerized-postfix-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 38 hours 9000/tcp mailcowdockerized-php-fpm-mailcow-1
“docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:13306->3306/tcp mailcowdockerized-mysql-mailcow-1
“/sbin/tini -g – /c…” 38 hours ago Up 38 hours (healthy) 3310/tcp, 7357/tcp mailcowdockerized-clamd-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 38 hours mailcowdockerized-sogo-mailcow-1
“docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:18983->8983/tcp mailcowdockerized-solr-mailcow-1
“/docker-entrypoint.…” 38 hours ago Up 32 hours 53/tcp, 53/udp mailcowdockerized-unbound-mailcow-1
“/bin/sh -c /watchdo…” 38 hours ago Up 38 hours mailcowdockerized-watchdog-mailcow-1
“python3 -u /app/ole…” 38 hours ago Up 38 hours mailcowdockerized-olefy-mailcow-1
“docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:7654->6379/tcp mailcowdockerized-redis-mailcow-1
“docker-entrypoint.s…” 38 hours ago Up 38 hours 11211/tcp mailcowdockerized-memcached-mailcow-1
“python3 -u /app/doc…” 38 hours ago Up 38 hours mailcowdockerized-dockerapi-mailcow-1

[unknown]
619a9cedb7bf robbertkl/ipv6nat “/docker-ipv6nat-com…” 38 hours ago Up 38 hours mailcowdockerized-ipv6nat-mailcow-1
0cd2a1c9a977 mailcow/netfilter:1.48 “python3 -u /server.…” 38 hours ago Up 38 hours mailcowdockerized-netfilter-mailcow-1
1fe33886c984 mailcow/acme:1.82 “/sbin/tini -g – /s…” 38 hours ago Up 38 hours mailcowdockerized-acme-mailcow-1
2a2996c8723e mailcow/rspamd:1.90 “/docker-entrypoint.…” 38 hours ago Up 38 hours mailcowdockerized-rspamd-mailcow-1
663c9358c5fd mcuadros/ofelia:latest “/usr/bin/ofelia dae…” 38 hours ago Up 38 hours mailcowdockerized-ofelia-mailcow-1
7f607330f7df nginx:mainline-alpine “/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp mailcowdockerized-nginx-mailcow-1
1d0bdd3233a3 mailcow/dovecot:1.20 “/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:110->110/tcp, :::110->110/tcp, 0.0.0.0:143->143/tcp, :::143->143/tcp, 0.0.0.0:993->993/tcp, :::993->993/tcp, 0.0.0.0:995->995/tcp, :::995->995/tcp, 0.0.0.0:4190->4190/tcp, :::4190->4190/tcp, 127.0.0.1:19991->12345/tcp mailcowdockerized-dovecot-mailcow-1
18a669978ffb mailcow/postfix:1.68 “/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:25->25/tcp, :::25->25/tcp, 0.0.0.0:465->465/tcp, :::465->465/tcp, 0.0.0.0:587->587/tcp, :::587->587/tcp, 588/tcp mailcowdockerized-postfix-mailcow-1
8a294f9f8b0f mailcow/phpfpm:1.79 “/docker-entrypoint.…” 38 hours ago Up 38 hours 9000/tcp mailcowdockerized-php-fpm-mailcow-1
192fa6d811da mariadb:10.5 “docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:13306->3306/tcp mailcowdockerized-mysql-mailcow-1
ea04de72e83a mailcow/clamd:1.54 “/sbin/tini -g – /c…” 38 hours ago Up 38 hours (healthy) 3310/tcp, 7357/tcp mailcowdockerized-clamd-mailcow-1
9f1bae3ed85d mailcow/sogo:1.111 “/docker-entrypoint.…” 38 hours ago Up 38 hours mailcowdockerized-sogo-mailcow-1
80900476bdbd mailcow/solr:1.8.1 “docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:18983->8983/tcp mailcowdockerized-solr-mailcow-1
652ca096857f mailcow/unbound:1.16 “/docker-entrypoint.…” 38 hours ago Up 32 hours 53/tcp, 53/udp mailcowdockerized-unbound-mailcow-1
47512f97f42e mailcow/watchdog:1.96 “/bin/sh -c /watchdo…” 38 hours ago Up 38 hours mailcowdockerized-watchdog-mailcow-1
554999b7aacb mailcow/olefy:1.10 “python3 -u /app/ole…” 38 hours ago Up 38 hours mailcowdockerized-olefy-mailcow-1
1a8993d2bea4 redis:6-alpine “docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:7654->6379/tcp mailcowdockerized-redis-mailcow-1
06ac737160c5 memcached:alpine “docker-entrypoint.s…” 38 hours ago Up 38 hours 11211/tcp mailcowdockerized-memcached-mailcow-1
8eb5ac044d35 mailcow/dockerapi:1.42 “python3 -u /app/doc…” 38 hours ago Up 38 hours mailcowdockerized-dockerapi-mailcow-1

aaronsmith

Another thought: Make sure despite your systems memory allocation that the claims container is not crashing.

docker compose ps
docker ps

Will help you check the uptime of the containers relative to each other. It’s possible the container is crashing.
mailcow/mailcow-dockerized3371

Also, I believe by default the container listens on port 3310 for things to scan. But if you did any customizations or overrides, maybe its pointing to the wrong container/port.

cd data/conf/rspamd/local.d/
cat antivirus.conf

Look for " servers = “clamd:<PORT>” and compare to the port used by claimd-mailcow container.

Also check rspamd overrides (data/conf/rspamd/override.d) and make sure you didn’t configure an override to antivirus.conf.

mailcow/mailcow-dockerized2045

posixaz

aaronsmith
All containers working well ,about 38 hours.

docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
619a9cedb7bf robbertkl/ipv6nat “/docker-ipv6nat-com…” 38 hours ago Up 38 hours mailcowdockerized-ipv6nat-mailcow-1
0cd2a1c9a977 mailcow/netfilter:1.48 “python3 -u /server.…” 38 hours ago Up 38 hours mailcowdockerized-netfilter-mailcow-1
1fe33886c984 mailcow/acme:1.82 “/sbin/tini -g – /s…” 38 hours ago Up 38 hours mailcowdockerized-acme-mailcow-1
2a2996c8723e mailcow/rspamd:1.90 “/docker-entrypoint.…” 38 hours ago Up 38 hours mailcowdockerized-rspamd-mailcow-1
663c9358c5fd mcuadros/ofelia:latest “/usr/bin/ofelia dae…” 38 hours ago Up 38 hours mailcowdockerized-ofelia-mailcow-1
7f607330f7df nginx:mainline-alpine “/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp mailcowdockerized-nginx-mailcow-1
1d0bdd3233a3 mailcow/dovecot:1.20 “/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:110->110/tcp, :::110->110/tcp, 0.0.0.0:143->143/tcp, :::143->143/tcp, 0.0.0.0:993->993/tcp, :::993->993/tcp, 0.0.0.0:995->995/tcp, :::995->995/tcp, 0.0.0.0:4190->4190/tcp, :::4190->4190/tcp, 127.0.0.1:19991->12345/tcp mailcowdockerized-dovecot-mailcow-1
18a669978ffb mailcow/postfix:1.68 “/docker-entrypoint.…” 38 hours ago Up 38 hours 0.0.0.0:25->25/tcp, :::25->25/tcp, 0.0.0.0:465->465/tcp, :::465->465/tcp, 0.0.0.0:587->587/tcp, :::587->587/tcp, 588/tcp mailcowdockerized-postfix-mailcow-1
8a294f9f8b0f mailcow/phpfpm:1.79 “/docker-entrypoint.…” 38 hours ago Up 38 hours 9000/tcp mailcowdockerized-php-fpm-mailcow-1
192fa6d811da mariadb:10.5 “docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:13306->3306/tcp mailcowdockerized-mysql-mailcow-1
ea04de72e83a mailcow/clamd:1.54 “/sbin/tini -g – /c…” 38 hours ago Up 38 hours (healthy) 3310/tcp, 7357/tcp mailcowdockerized-clamd-mailcow-1
9f1bae3ed85d mailcow/sogo:1.111 “/docker-entrypoint.…” 38 hours ago Up 38 hours mailcowdockerized-sogo-mailcow-1
80900476bdbd mailcow/solr:1.8.1 “docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:18983->8983/tcp mailcowdockerized-solr-mailcow-1
652ca096857f mailcow/unbound:1.16 “/docker-entrypoint.…” 38 hours ago Up 32 hours 53/tcp, 53/udp mailcowdockerized-unbound-mailcow-1
47512f97f42e mailcow/watchdog:1.96 “/bin/sh -c /watchdo…” 38 hours ago Up 38 hours mailcowdockerized-watchdog-mailcow-1
554999b7aacb mailcow/olefy:1.10 “python3 -u /app/ole…” 38 hours ago Up 38 hours mailcowdockerized-olefy-mailcow-1
1a8993d2bea4 redis:6-alpine “docker-entrypoint.s…” 38 hours ago Up 38 hours 127.0.0.1:7654->6379/tcp mailcowdockerized-redis-mailcow-1
06ac737160c5 memcached:alpine “docker-entrypoint.s…” 38 hours ago Up 38 hours 11211/tcp mailcowdockerized-memcached-mailcow-1
8eb5ac044d35 mailcow/dockerapi:1.42 “python3 -u /app/doc…” 38 hours ago Up 38 hours mailcowdockerized-dockerapi-mailcow-1
bf0019f20169 portainer/portainer-ce:latest “/portainer” 2 months ago Up 2 days 0.0.0.0:8000->8000/tcp, :::8000->8000/tcp, 0.0.0.0:9443->9443/tcp, :::9443->9443/tcp, 9000/tcp

posixaz

any way edit my own message?

aaronsmith

Yes there should be an edit button for you in the lower right corner of a post.

Sorry to hear my suggestions have not helped. I suppose the good news is you’re seeing clamd working.

Perhaps the reason you’re seeing this sometimes is because the file attachment size is too big for clamav to complete the scan in the time that rspamd is waiting? Mailu/Mailu2321

Suggest adding an entry to data/conf/rspamd/local.d/antivirus.conf (since it does not appear to use the .include map to source override.d)

clamav { ... timeout = 10; }

This sets the timeout to 10 seconds that rspamd will wait for clamav to complete its work. You may need to adjust that value based on your continued observations of that error.

Once you apply the changes and restart the container, you could login to that container (https://docs.mailcow.email/troubleshooting/debug-attach_service/) and verify the configuration:
rspamadm configdump clamav

https://rspamd.com/doc/modules/antivirus.html
https://www.rspamd.com/doc/faq.html#what-are-local-and-override-config-files

posixaz

aaronsmith
Thank you for your detailed answer,
just added these 2 lines and monitoring ,till now its going good.

timeout = 10;
retransmits = 2;

regards,
Hafiz.