Resolved Amavis virus scanning silently disabled - bypass_virus_checks fallback due to missing SQL column (Plesk 18.0.81.2)

[Fabian]

Server operating system version

Ubuntu 26.04.1

Plesk version and microupdate number

18.0.81 #2

Hello,

I discovered that incoming mail is NOT being virus-scanned on this server, even though ClamAV (clamav-daemon) is running correctly and clamdscan detects the EICAR test file without issue when run directly.

Root cause: Amavis (the content filter between Postfix and ClamAV) has the following in the Plesk-generated config /etc/amavis/conf.d/99-email-security:

@bypass_virus_checks_maps = (1);

This unconditionally skips virus checking for all mail. Simply commenting out this line does not fix the problem - with debug logging enabled ($log_level = 5), Amavis tries to read the bypass_virus_checks value from Plesk's own SQL database (the emailsecurity database, policy table) instead, but that column does not exist there ("no such fields: bypass_virus_checks"). When the lookup fails, Amavis falls back to a hardcoded value of "1" (= bypass active), silently disabling virus scanning for the whole server.

So the actual issue is a mismatch between what Amavis's Plesk-generated config expects to find in the emailsecurity.policy table and what that table's schema actually contains on this installation.

Impact: Virus scanning is completely inactive for incoming mail, with no error or warning visible anywhere in the Plesk panel - everything looks "enabled" and ClamAV itself reports healthy. This could easily go unnoticed on any server affected by the same schema mismatch.

Happy to provide the full Amavis debug log or the emailsecurity.policy table schema if that helps track this down.

 

[Martin Dias]

Hi, do you have the extension licensed? The line you mention is added when ClamAV is not installed, not toggled on or not licensed normally

 

[Fabian]

Hi, thanks for the pointer - you're right.

Checked it on my end: `plesk bin extension --list` shows no licensed antivirus/ClamAV extension, and I can't find any ClamAV-related entry in the installed license either. This is a Strato-bundled "Plesk 12 VPS Web Admin" license, so it looks like the email antivirus component simply isn't part of it.

clamav-daemon itself was running as an independently installed system package (not through Plesk's licensed component), which is why clamdscan detected the EICAR test file directly when run manually - but Plesk/Amavis never actually hooks it in, since the licensed feature set doesn't include it, hence the permanent bypass_virus_checks fallback.

So this is most likely not a bug on Plesk's side - it's expected behavior when the antivirus extension isn't licensed. Apologies for the noise. The only minor suggestion I'd make: it might be worth showing a clearer status in the Mail Settings panel (e.g. "Antivirus not available - not licensed") instead of silently defaulting to bypass with no indication, since it can be confusing when the underlying clamav-daemon package happens to still be present and functional on the system.

Thanks again for clearing this up!