antivirus – Antivirus Modules

clamav {}
csapi {}
antivirus "antivirus1" {
  csapi "csapi1" {
    enabled = false
    action = "pass"
    context_variable = "virus"
    max_concurrency = 4
  }
  clamav "clamav1" {
    enabled = false
    action = "pass"
    ...
  }
}

action

(reject|quarantine|pass) The behavior to exhibit on a positive match. When action is set to reject this module rejects in the most conservative way—both "infected" and "unscannable" messages will be rejected. If you wish to "pass" unscannable messages but reject "infected" messages then they will need to set action to pass and use a policy script to set the SMTP response behavior.

**Configuration Change. ** As of version 3.1, action can no longer be assigned the value quarantine.

cache_size

The size of the virus hash cache. Once a virus is present in the cache, matching is significantly faster. The default is 1000 viruses.

context_variable

The name of the context variable that will be set in the event of a positive match. If no value is assigned to context_variable, it defaults to "engine name _status", clamav_status for the ClamAV module, for example. If engine name _status is set to a value, this also sets another context variable named, "engine name _status_info", which usually contains the virus name.

If the option, context_variable, is assigned a value, then the value it is set to is used as the name of the context variable. This context variable will only be set if a virus is found or an error occurs. Additionally, a second variable, context_variable_info is also set. You can access this context variable from a Lua script using the msg:context_get function. To use this variable in a Sieve script see antivirus.

Note#

If no virus is found, then neither the default context variable engine name _status nor engine name _status_info will be set. The same applies when context_variable is assigned a value.

error_code

Set the ESMTP response code that should be sent if there is a problem scanning, not indicating the presence of any virus. Defaults to 451 (Requested action aborted: local error in processing). You should not normally set this to a fatal (5XX error code).

file_base

A path that the Momentum process can write temporary files into before scanning. Large messages need to be written out in canonical form before the scanner can be called. If you have enabled mime_decompose, those files will be stored here as well. /tmp or /var/tmp are good choices for most systems. Temporary files are deleted immediately after virus scanning.

max_concurrency

Each antivirus engine runs in a default threadpool (see individual documentation for your AV engine for details). By setting max_concurrency to a non-zero value, you can limit how many antivirus threads will be run simultaneously. Default is 0, which will mean as many threads as are available in the threadpool. To change the thread pool used by a given engine, you may use the pool option.

Note#

If you use the csapi module be sure to set the concurrency of the CPU threadpool to a value that is less than the max_concurrency of the csapi module.

mime_decompose

Have Momentum decompose any MIME-encoded messages and scan the parts individually, instead of relying on the AV engine to decompose messages. Requires file_base to be set as well. The default value for this option is 0.

paranoid

Mark as viruses mails which appear to have been constructed to bypass virus checkers. The default value for this option is 0.

pool

Run all antivirus scans out of a dedicated threadpool. AV scanners that run in-process default to the CPU pool and scanners that call an external process default to the IO pool. See threadpool for details on creating custom threadpools.

skip_context_variable

If this context variable is set by another module, the AV subsystem will avoid running the scanner on the current message. The default value for this variable is "skip_virus_check".

timeout

How long to wait for the engine to return a result for a particular message. Default is 10 seconds.

use_wire_rep

**Configuration Change. ** This feature is available starting from Momentum 3.5.1.

If use_wire_rep = true (the default setting), then a dot-stuffed representation of the message is held entirely in memory and can be used as received, rather than loading pieces of the message as needed.

If use_wire_rep = false, then a dot-unstuffed representation of the message will be generated and passed to the module. In addition, any local modifications made to the message will be passed to the Antivirus engine.

15:42:50 /tmp/2025> antivirus:antivirus1 stats
clamav
  Messages checked:   0
  MIME parts checked: 0
  Viruses detected:   0
  Viruses cured:      0
  Avg. time/message   nanms
  Avg. time/MIME part nanms
csapi
  Messages checked:   5
  MIME parts checked: 5
  Viruses detected:   1
  Viruses cured:      0
  Avg. time/message   14.994ms
  Avg. time/MIME part 14.994ms

12:15:22 /tmp/2025> antivirus:antivirus1 version
antivirus: symantec DEC scanner version number: 5.2.3.6
AV scanner version number: 9.1.3.30
AV definitions version: 20150215.001
Up to date