ClamAV - Reset Defs DB
Sometimes ClamAV will download a virus update, and the MD5 will be wrong. If it is, then ClamAV usually goes down, and the system suspends delivery.
Symptoms:
You'll know this is the case if you go to the /var/log/zimbra.log and you see that ClamAV isn't running, postfix/qmgr errors out at 'delivery temporarily suspended', messages like 'malformed database' in /opt/zimbra/log/clamd.log, and by checking zmclamdctl status.
To fix this, you can delete the defs and try again:
su - zimbra mkdir /tmp/clamdb mv /opt/zimbra/clamav/db/* /tmp/clamdb zmprov ms `zmhostname` +zimbraServiceEnabled antivirus /opt/zimbra/clamav/bin/freshclam --config-file=/opt/zimbra/conf/freshclam.conf zmantivirusctl stop zmantivirusctl start
zmantivirusctl incorporates (or zmclamdctl/zmamavidsctl/zmmtaconfigctl)
In ZCS 5.0.3+ we moved to a data directory to keep separate from application data, replace the above with:
/opt/zimbra/data/clamav/db
Verify by running:
/opt/zimbra/clamav/bin/clamscan -d /opt/zimbra/data/clamav/db/