Spamd and clamd connection refused / connection denied

OS type and version AlmaLinux release 9.1
Virtualmin version 7.5

Hi all,

I’ve noticed in my maillogs the follwoing:

==> /var/log/procmail.log <==
ERROR: Could not connect to clamd on LocalSocket /run/clamd.scan/clamd.sock: Permission denied

The socket seems to be writable to world:

[root@HOST ~]# ls -lah /run/clamd.scan/clamd.sock
srw-rw-rw- 1 clamscan clamscan 0 Jan 18 18:01 /run/clamd.scan/clamd.sock

Additionally, I’ve tried to finetune spamassassin a bit, but now I get the following in the mail logs:

==> /var/log/maillog <==
Jan 27 09:45:00 HOST spamc[932651]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused

Not sure what I did to break it.
I did enable some plugins in /etc/mail/spamassassin/*.pre but nothing I can imagine that would have a breaking effect.
spamd process is still running:

root      927446  0.0  0.6 116808 109412 ?       Ss   09:11   0:01 /usr/bin/perl -T -w /usr/bin/spamd -c -m5 -H --razor-home-dir=/var/lib/razor/ --razor-log-file=sys-syslog

but as far as I can tell, it’s not listening on any network socket:

[root@HOST ~]# netstat -tulpn | grep spamd
[root@HOST ~]#

The spamassassin config in the Virtualmin UI does not provide any sockets as far as I can tell.

I think spamd is listening on port 783:

tcp        0      0 *               LISTEN      933133/perl  

connecting to it works:

# telnet 783
Connected to
Escape character is '^]'.
SPAMD/1.0 79 Timeout: (30 second socket timeout reading input from client)
Connection closed by foreign host.

I notice before I started messing with the spamassassin configurationthat the following appeared in the logs when an e-mail message was supplied to spamd:

Jan 27 06:33:20 HOST spamc[889769]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Jan 27 06:33:20 HOST spamd[871045]: spamd: connection from []:52436 to port 783, fd 5

It appears spamd is not attempting to connect anymore on ipv4, but only on ipv6?

I’ve found the logs are just not appearing in the /var/log/maillog anymore but are still available in the journalctl (journalctl -xef -u spamassassin).
I’m comparing configuration between this host and a freshly installed virtualmin, but can’t readily see what’s causing the change in log location.