SYSTEM INFORMATION OS type and version Rocky Linux 9.8 Virtualmin version 8.1.0 Professional When I initially configured Virtualmin (years ago) on this server, I set up ClamAV such that clamscan is running all the time (typically taking up around 1GB of 16GB RAM available). I assume it has been working since, as I’ve never seen errors in the maillog before now. Recently when I was looking at the Procmail log (for another reason) I noticed the following error everywhere (one instance for every piece of email coming into the server): ERROR: Could not connect to clamd on LocalSocket /run/clamd.scan/clamd.sock: Permission denied I’m not sure when this began occurring, though most recently I have added SpamHaus upstream by using their DQS configuration and plugin for SpamAssassin (this is probably unrelated, but I mention it here as I do remember reading that they reconfigure SpamAssassin just a bit in order to improve filtering, and indeed my spam filtering was much improved after so doing). I verified that the file in question (clamd.sock at the location above) does exist and has these permissions: srw-rw-rw- with group/owner as clamscan. I don’t know what troubleshooting steps I should take next? The procmail log is so awash with these errors, I was so surprised! One error per email (even for the emails marked as Mode:Spam).

@Armmiss Thanks for this, I had seen this post when I researched mine, but I was afraid that opening up permissions more wasn’t necessarily the right thing to do in this case. I try to keep permissions at their least permissive, and I try not to modify things on the server away from their defaults unless it’s absolutely essential. I ended up doing something different, but you’re right that setting the permissions to 755 on every boot would have worked too, had I done that. Here’s what I did instead, after discussing this thread with an AI and also following up its recommendations on Stack Exchange threads for confirmation: usermod -aG clamscan postfix I then restarted Postfix (and also restarted ClamAV). Here is the background that the AI gave me for going this route: By adding postfix to the clamscan group instead of doing chmod 755, you’re following the principle of least privilege. With the existing 710 permissions, group members get the --x (traverse) right they need. Only the postfix user (and clamscan itself) can now traverse the directory. Everyone else is still blocked. Indeed the errors about the socket connection permissions are now gone from the mail log! :slight_smile:

How often does Clam catch problem emails, and when was the last timer it did so?

SpamAssassin is unrelated. Are you sure you’re up to date on the ClamAV packages? There’s an old bug about this issue here: 2006490 – clamd will not start after upgrade to clamav-0.103.3-5.el7.x86_64

But, that’s so old, I can’t imagine it’s ever been true of packages for EL 9, though…so, maybe a red herring.

[image] Emails not being scanned by SpamAssassin Virtualmin i’ve edited the spamc.conf file to the: # connect to "server.example.com", port 783 -d 127.0.0.1 -p 783 # max message size for scanning = 350k -s 350000 from https://spamassassin.apache.org/full/3.4.x/doc/spamc.html now the procmail: Rescue of unfiltered data succeeded procmail: Program failure (78) of "/bin/spamc" Line not terminated with a newline in /etc/mail/spamassassin/spamc.conf doesnt show anymore but i still get: ERROR: Could not connect to clamd on LocalSocket … Check this thread, I had the same issue some time ago.

[image] Joe: Are you sure you’re up to date on the ClamAV packages? I ran freshclam and it said I was 1 version behind, so I updated it, seemingly successfully: SelfCheck: Database modification detected. Forcing reload. Reading databases from /var/lib/clamav Database correctly reloaded (3627885 signatures) Activating the newly loaded database... I also tried restarting the clamscan process in case that might help: Started clamd scanner (scan) daemon. Image (graphics) scanning support enabled. Detection using image fuzzy hash enabled. AlertExceedsMax heuristic detection disabled. Heuristic alerts enabled. Portable Executable support enabled. ELF support enabled. Mail files support enabled. OLE2 support enabled. PDF support enabled. SWF support enabled. HTML support enabled. XMLDOCS support enabled. HWP3 support enabled. OneNote support enabled. Self checking every 600 seconds. I looked at the posts linked to the replies above, but wasn’t really sure how to proceed further. I’m afraid I don’t know that much about how ClamAV works on my server. Is there any way to query ClamAV to determine why it feels it doesn’t have permissions to use that .sock file (to which I’m pretty sure it does have permissions)? I hesitate to edit any configuration files, since they’re all just the ones made by Virtualmin out-of-the-box when I ran the installer on a fresh instance of Rocky Linux 9 in 2022 (having kept up-to-date with all package updates since then).

[image] vtrh: Check this thread, I had the same issue some time ago. From that link: The owner of clamd.sock is clamscan:clamscan permission 0666 and it has 0 bytes changed the folder permission to 0755 and the error is gone. I do see how this bit of advice might well help, but I am so nervous about making anything more permissive than it needs be, which is why I posted the permissions for /run/clamd.scan/clamd.sock in my original post srw-rw-rw- in case these were obviously incorrect.

[image] Randomz: How often does Clam catch problem emails, and when was the last timer it did so? I’m not sure honestly how to check this? I’ve always just assumed it was running fine in the past, since the ClamAV server status had a green checkmark next to it, and there were no errors in the maillogs. I’m not sure when these errors started as I can’t recall when I was last looking at the maillogs in detail. I’ve done the usual number of routine updates and reboots over the past month.

[image] itmustbe: I ran freshclam That updates the virus database, not the packages. Packages come from your package manager (dnf).

Oh right, of course it does. I tried clamscan --version on my system and it gave me this: ClamAV 1.4.3/28044/Fri Jun 26 23:24:28 2026

I assume this is all as it should be too (particularly the on-access scanner piece?): [Screenshot 2026-06-27 at 9.41.27 AM]

Sudden Clam Scan Log Errors

Help! (Home for newbies)

vtrh June 27, 2026, 12:17pm 5

Check this thread, I had the same issue some time ago.