ClamAV and Domino

 I am not an expert on Anti-virus things and Domino, that would be Daniel Nashed.

But if HCL Domino has something new, I test it out and set it up on my server.

In this case, I had heard that ClamAV would now work with Domino as of 14.5.1.

Having used Clam for many years at the OS level, I wanted to play with this in Domino.

My server is Windows, not Linux, ClamAV Linux instructions are pretty common, Windows, not as much.

Boy was this the hardest "easy' thing to do ever.

To start, HCL provides no documentation.

There are only 3 references to ClamAV in the official docs:

https://help.hcl-software.com/domino/14.5.1/admin/wn_config_features_1451.html#wn_config_features_1451__section_fq1_wgc_23c

https://help.hcl-software.com/domino/14.5.1/admin/conf_configuringscanninginscscancfg.html?hl=clamav

https://help.hcl-software.com/domino/14.5.1/admin/conf_scanningattachmentsforviruses.html?hl=clamav

None of which tell you much about how to set up ClamAV or how to configure it for Domino integration.

I opened a ticket and eventually was directed to this post:

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129703

Which is in Japanese. Use Google Translate or Chrome built in translstion.

I see now, at my urging, HCL has released the same document in English.

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131220

Their perspective is that we should go to ClamAv to set it up and then magically know how to integrate it.

I asked why it wasn't in the actual documentation and got a runaround answer, given HCL announced the availability, not ClamAV.

The new technical document covers some of the set up required.

I am going to add what is missing, more for my benefit, and anyone else who will try this on their servers.

Step 1 is Download the ClamAV from the link in the document, https://www.clamav.net/downloads and install it. BUT this does not tell you how to set it up in Services.

For that, you perform this:

Open the Windows Command Prompt as an Administrator and navigate to your ClamAV folder.

Run the following command to install the ClamAV daemon service:
clamd.exe --install

Remember to set it to automatic.

Step 2 is to copy the config file as described and perform the edits.

Step 3, however, did not work for me no matter how I tried to get the certificate. Even with HCL Support help, they eventually had to send me the certificate required.

Step 4: You have to get the updated virus definitions. NOTE: This is a once off effort. And Manual.

If you want it to be automatic, and you do, you need to do these steps.

Open the Windows Command Prompt as an Administrator and navigate to your ClamAV folder.

Run the following command to install the ClamAV daemon service:
freshclam.exe --install

Once you Load mailscan at the Domino server console you will get the cscancfg.nsf and need to follow the document entries as provided.

NOTE: The ClamAV server name(DNS) must be 127.0.0.1. Do not put your server IP there, it will not work at all.

Make sure you open port 3310 with your local server firewall, and in my case, the outside ISP.

I changed the Subject Prefix Scanned field default text to something I would know came from my server, not a spammer.

Lastly, make sure you add Mailscan to your tasks line in your notes.ini also something not mentioned in the document that is kind of important, unless you like having your mail stuck in mail.box and spend 2 hours troubleshooting it one morning, like I just did.

I eventually figured out it was an AV issue when running SMTPDebugClient=1 and

Tell Router list run from the server console.

You see this:

Mbx NoteID          ID          State          Size Pri Count ScheduledDate           From

  1 000008FE 0028261D Wait AV        8443         1                         K Brooks/org

  2 00000902 00283C39 Wait AV       13306         1                         kbrooks@test.com

  1 00000902 002864E3 Wait AV        8749         1                         keith@gmail.com

  2 00000906 00287C9A Wait AV        8640         1                         keith@gmail.com

Oh, that makes sense after the server restarted late yesterday. Mailscan was not in tasks.

So, my time spent, is your time gained.

12.0.2 FP8 didn't update version numbers

This is probably not a problem with FP8, to be upfront, but just in case I am using it for the title.

4 out of 8 servers at a customer did not chaaange tehir version number when I updated them to FP8.

They stayed FP7.

In the past, I have had this issue where updates don't happen, due to various reasons like a corrupted NAB, failed hot fix removals, etc..

But this was different because 4 servers, DEV domain, were fine.

QUAL domain is not updated.

How Did I Get Here

Servers were 12.0.2 FP7 HF1 Windoews 2019

I shut the Domino server down, including the Domino service.

Paused the Windows Management service(ONLY affects HF's for some reason), then ran the hot fix as administrator to remove it.

Started the server from the icon asd a regular application, so I can see it running, and a "sh ser" showed the correct FP7 version. Let it run for a few minutes till I saw HTTP start and some other tasks. Then shut it down.

Run FP8 as an administrator, runs fine, no errors.

Restart the box, actually, 2 servers had issues with the Domino service login, and I restarted the whole VM, the other 2 the service started fine.

Waited to see the server docs change, and nothing.

The upgrade.log showed everything looked ok.

I opened a ticket with HCL after the 1st 4 failed to update, then I checked the next 4 and those worked.

The Resolution and Reasoning

Sooraj from HCL Support provided me with the following resolution and an explanation after I provided some files and screenshots.

Take a backup of the files below and replace them from a "working" server [12.0.2FP8]

Domino\nstrings.dll
Domino\res\C\nstrings.res

Shutdown the incorrect Domino server
Take a backup of the two files mentioned above.
Copy similar files from a working 1202FP8 server and replace them.

(I left the existing ones, and added a _BAD at the end of the name)

Start the Domino server.

While I asked to close the ticket, I also wanted an explanation for future thoughts. 

Sooraj provided the following:

This problem was reported for the first time, and based on my analysis, it appears that those two files were not updated by the FP8 installer. It was still using the FP7 code. This ideally occurs due to an access issue with the account that started the installation, but unfortunately, I cannot confirm this because the upgrade.log doesn't show any such errors.

Possibly a server processing issue, a delay, or perhaps not fully completing a virus scan, or some other local issue was to blame.

But on 4 servers, I don't believe so. 

One, sure, things happen. 

In this situation, all 4, well, 8, are nearly identical setups.

Hope this helps others with similar issues at some time in their admin journeys.