I want to scan only incoming messages with Clamav, is there any way to do this? BTW I see on the mail queue a lot of emails from users to [email protected]ldomain with subject "Mailsize" and with the body containing a string of decimal numbers. Thanks in advance.
Clamav in ISPCOnfig is only scanning incoming messages. Thats correct. This mechanism creates your mail statistics.
Looking into maillog I can see a "bottleneck" between Postfix queue and Amavis, when an email arrives to Postfix takes a long time to deliver to give amavis. Look this log: May 31 08:18:35 mail postfix/smtpd[7441]: 70BAAAD00C6: client=unknown[192.168.216.92], sasl_method=LOGIN, sasl_username=plucchetti.mydomain May 31 08:18:35 mail postfix/qmgr[7367]: 70BAAAD00C6: from=<[email protected]>, size=11499, nrcpt=1 (queue active) May 31 08:20:28 mail postfix/qmgr[28233]: 70BAAAD00C6: from=<[email protected]>, size=11499, nrcpt=1 (queue active) May 31 08:23:49 mail postfix/qmgr[28233]: 7E441AD00F2: from=<[email protected]>, size=12244, nrcpt=1 (queue active) May 31 08:23:49 mail amavis[20618]: (20618-03-10) Passed CLEAN, LOCAL [192.168.216.92] [192.168.216.92] <[email protected]> -> <[email protected]>, Message-ID: <[email protected]>, mail_id: YueIcHwvfSN1, Hits: 3.152, queued_as: 7E441AD00F2, 15151 ms May 31 08:23:49 mail postfix/smtp[28240]: 70BAAAD00C6: to=<[email protected]>, orig_to=<[email protected]>, relay=127.0.0.1[127.0.0.1], delay=314, status=sent (250 2.6.0 Ok, id=20618-03-10, from MTA([127.0.0.1]:10025): 250 Ok: queued as 7E441AD00F2) May 31 08:24:29 mail postfix/local[5690]: 7E441AD00F2: to=<[email protected]>, relay=local, delay=40, status=sent (delivered to command: /usr/bin/procmail -f-) This time is increased when emails traffic is bigger. Any help, please?