[CPANEL-28012] Incomplete ClamAV Plugin Uninstall

gramzon

• June 12, 2019 08:42

After uninstalling ClamAV plugin my Exim logs are flooded with messages like this: malware acl condition: clamd /var/clamd : unable to connect to UNIX socket (/var/clamd): No such file or directory
I tried to comment out the av_scanner line from /etc/exim.conf but then a different message started filling the logs: malware acl condition: sophie /var/run/sophie : unable to connect to UNIX socket (/var/run/sophie)
I can not find any option under Exim Configuration Manager that disables scanning

• 

  gramzon

  • June 13, 2019 10:39

  I was making changes to Exim routers and transport today via "Exim Configuration Manager" under advanced settings (setting up ESET mail scanner), and after saving changes the message no longer appears in the logs. Maybe the problem was that I restarted Exim with systemctl after commenting out av_scanner line from /etc/exim.conf, and not via the interface. I also noticed that now the line av_scanner is no longer present in the conf file (not even as a comment) On a side note, each incoming email shows up twice in "Mail Delivery Reports" since activating ESET mail scanner. Is this normal behavior?

  0
• 

  cPanelMichael

  • June 18, 2019 19:10

  Hello @gramzon, Thanks for the additional information. I was able to reproduce the issue Internal case CPANEL-28012 is now open to address an issue where uninstalling the ClamAV plugin does not result in the removal of the "av_scanner = clamd:/var/clamd" line from /etc/exim.conf until the next time the Exim configuration file is built. This can lead to the following error seen in /var/log/exim_mainlog: [QUOTE] malware acl condition: clamd /var/clamd : unable to connect to UNIX socket (/var/clamd): No such file or directory
  The temporary workaround is to manually execute the following command immediately following the ClamAV uninstallation: /scripts/buildeximconf
  I'll monitor the case and update this thread with more information on it's status as it becomes available. Thank you.

  0
• 

  cPanelMichael

  • August 26, 2019 20:30

  Hello, To update, this was fixed as part of the update to ClamAV in cPanel & WHM version 82.0.10: Fixed case CPANEL-28735: Update rpm.versions for cpanel-clamav 0.101.3-1.cp1180. Let us know if the issue persists after updating to Panel & WHM version 82.0.10 or newer. Thank you.

  0

Please sign in to leave a comment.