Spamd and clamd connection refused / connection denied

OS type and version AlmaLinux release 9.1
Virtualmin version 7.5

Hi all,

I’ve noticed in my maillogs the follwoing:

==> /var/log/procmail.log <==
ERROR: Could not connect to clamd on LocalSocket /run/clamd.scan/clamd.sock: Permission denied

The socket seems to be writable to world:

[root@HOST ~]# ls -lah /run/clamd.scan/clamd.sock
srw-rw-rw- 1 clamscan clamscan 0 Jan 18 18:01 /run/clamd.scan/clamd.sock

Additionally, I’ve tried to finetune spamassassin a bit, but now I get the following in the mail logs:

==> /var/log/maillog <==
Jan 27 09:45:00 HOST spamc[932651]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused

Not sure what I did to break it.
I did enable some plugins in /etc/mail/spamassassin/*.pre but nothing I can imagine that would have a breaking effect.
spamd process is still running:

root      927446  0.0  0.6 116808 109412 ?       Ss   09:11   0:01 /usr/bin/perl -T -w /usr/bin/spamd -c -m5 -H --razor-home-dir=/var/lib/razor/ --razor-log-file=sys-syslog

but as far as I can tell, it’s not listening on any network socket:

[root@HOST ~]# netstat -tulpn | grep spamd
[root@HOST ~]#

The spamassassin config in the Virtualmin UI does not provide any sockets as far as I can tell.

I think spamd is listening on port 783:

tcp        0      0 *               LISTEN      933133/perl  

connecting to it works:

# telnet 783
Connected to
Escape character is '^]'.
SPAMD/1.0 79 Timeout: (30 second socket timeout reading input from client)
Connection closed by foreign host.

I notice before I started messing with the spamassassin configurationthat the following appeared in the logs when an e-mail message was supplied to spamd:

Jan 27 06:33:20 HOST spamc[889769]: connect to spamd on ::1 failed, retrying (#1 of 3): Connection refused
Jan 27 06:33:20 HOST spamd[871045]: spamd: connection from []:52436 to port 783, fd 5

It appears spamd is not attempting to connect anymore on ipv4, but only on ipv6?

I’ve found the logs are just not appearing in the /var/log/maillog anymore but are still available in the journalctl (journalctl -xef -u spamassassin).
I’m comparing configuration between this host and a freshly installed virtualmin, but can’t readily see what’s causing the change in log location.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.