clamav and amavid

[bbranham]

On my server I have three domains which recieve mail properly.
Amavisd seems to act on all domains and I see header tags being applied properly.
Clamd on the other hand only seems to be working on some domains. Have I missed a place where the domains are listed for clamd to be active on?

[billb3]

This would probably be something for the amavis forum/mailing list, since clamd is called by Amavis not Scalix...

[deyjvu]

Have you made sure that you have a rule in place against the route that these other domains belong to... assuming you are asking this question here because you are using Scalix?

omshowrt -q all -d

will show you all the routes and the rules that apply to them. If you do not have a .VIR rule at the end of one of the lines then you have not setup the rule for this route.

for example

The global virus scanning/cleaning rule file exists

UNIX internet MIME ALL-ROUTES
UNIX internet,tnef TNEF ALL-ROUTES.VIR
LOCAL pfsmail ALL-ROUTES.VIR

In this scenario the route to "internet" does not have the ALL-ROUTES.VIR rule applied to it and it is this rule that dictates if the messages bound for here get scanned.

Maybe this is your problem?

[les]

On my server I have three domains which recieve mail properly.
Amavisd seems to act on all domains and I see header tags being applied properly.
Clamd on the other hand only seems to be working on some domains. Have I missed a place where the domains are listed for clamd to be active on?

Depends on your setup.

In my setups clamav/amavis/spamassassin are integrated via sendmail, which is called from SMTPFILTER=TRUE via /var/opt/scalix/??/s/sys/smtpd.cfg. I have many clients with multiple domains and never have issues with clamd missing scanning certain domains. There is no need to tell clamd about domains, just stick it "in the path" of mail.

If your integrating direct into scalix via router rules (which is not the preferred method IMHO, biggest problem was if clamd had an error scanning it would kill the service router, effectively stopping the flow of email.) then it could be as deyjvu describes....