In

/usr/local/etc/amavisd.conf

I changed

@av_scanners = (
    ['clamav-socket',
    \&ask_daemon, ["CONTSCAN {}\n", '/var/run/clamav/clamd.sock'],
    qr/\bOK$/, qr/\bFOUND$/,
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);

to

@av_scanners = (
    ['clamav-socket',
    \&ask_daemon, ["CONTSCAN {}\n", 'X.X.X.X:3310'],
    qr/\bOK$/, qr/\bFOUND$/,
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);

Where X.X.X.X is my clamav server's local IP address.  Is that the correct config?  I could not find any docs.

Also, I noticed the @av_scanners_backup section.  Since there is no clamav freshclam service running on the iRedMail server anymore, do I need to change this also?  If so, how?

@av_scanners_backup = (
    ['clamav-clamscan', 'clamscan',
    "--stdout --disable-summary -r --tempdir=$TEMPBASE {}", [0], [1],
    qr/^.*?: (?!Infected Archive)(.*) FOUND$/ ],
);

Right.  That's very similar to what I did.

I was wondering what, if anything, to do with the @av_scanners_backup section?  I suppose it can be disabled.

Since making this change, I'm getting these errors in the /var/log/maillog file:

Aug  3 13:16:45 <mail.warn> mx amavis[92329]: (92329-01) (!)run_av (clamav-server) FAILED - unexpected , output="/var/amavis/tmp/amavis-20200803T131645-92329-R0b40gXT/parts: lstat() failed: No such file or directory. ERROR\n"
Aug  3 13:16:45 <mail.warn> mx amavis[92329]: (92329-01) (!)clamav-server av-scanner FAILED: CODE(0x8097b1738) unexpected , output="/var/amavis/tmp/amavis-20200803T131645-92329-R0b40gXT/parts: lstat() failed: No such file or directory. ERROR\n" at (eval 110) line 951.
Aug  3 13:16:45 <mail.warn> mx amavis[92329]: (92329-01) (!)WARN: all primary virus scanners failed, considering backups
Aug  3 13:16:45 <mail.err> mx amavis[92329]: (92329-01) (!!)AV: ALL VIRUS SCANNERS FAILED

The /var/amavis/tmp/amavis-XXX/parts directories do exist on the iredmail server, so it's not clear why the virus scans fail.  Any suggestions?

I don't think it is a connection problem.  avavis on the iredmail server is connecting to the clamav server, because in the /var/log/clamav/clamd.log file I see entries like this:

WARNING: lstat() failed on: /var/amavis/tmp/amavis-20200803T230013-12526-6msKJSpY/parts
WARNING: lstat() failed on: /var/amavis/tmp/amavis-20200803T230014-12527-qTOkrG5F/parts

But, no additional details.  In clamd.conf, the value LogVerbose is "yes", but this is all that is shown.

I've seen permissions issues related to clamav servers in other posts, but in those cases the error messages clearly say "Permission Denied".  In my case, it is saying the file does not exist.  Still, it could be related.

What permissions and users do you have configured on your clamav-cluster-inet server?

Ok, so you're saying that the maillog message only refers to the MIME parts, but the rest of the message was scanned by the clam-av server successfully, correct?

Ok, I understand.

I have verified that my remote ClamAV server is working correctly, because it is also used by my nextcloud server.  Uploading a test virus to nextcloud triggers the remote clamd process successfully.  So, I am sure the problem is with how iredmail's amavis calls clamd.

I saw this article, that says the scanning temporary directory must be shared (NFS) for the CONTSCAN command to work.
https://amavis-users.amavis.narkive.com … g-anything

I suspect that your cluster instance works because you are sharing that temporary directory between the clamav server and the amavis server.

There does appear to be a clamav command called INSTREAM (or zINSTREAM) that would send the files to clamd in a stream without the need to share a common temporary directory.  However, I wasn't able to find any documentation on how to use INSTREAM with amavis in the amavisd.conf file.  It looks like you need to specify the size of the stream and other info.
https://linux.die.net/man/8/clamd

It'd be great if there was a way to use INSTREAM, but until then, I'll share the directories.