how to keep/add sender IP in Amavisd antivirus "INFECTED" discard notice?

jasonsu at jasonsu at
Wed Apr 13 15:44:34 CEST 2016

I have Amavis set up to do A/V scanning as a prequeue filter.

It's configured to DISCARD virus-tagged content.

It works , detecting + discard as intended.

I want to run fail2ban over the logs to identify the IP of the Virus sender, and set a firewall block for awhile.

But if you look at the log for the amavis rejection message sent to postfix, it does NOT have the IP address.

	Apr 11 04:24:08 mail01 postfix/postscreen[7312]: CONNECT from []:1024 to []:25
	Apr 11 04:24:14 mail01 postfix/postscreen[7312]: PASS NEW []:1024
	Apr 11 04:24:14 mail01 postfix/psint/smtpd[7319]: connect from[]
	Apr 11 04:24:15 mail01 postfix/psint/smtpd[7319]: NOQUEUE:[]
	Apr 11 04:24:15 mail01 postfix/amavis/smtpd[7326]: connect from localhost[]
	Apr 11 04:24:15 mail01 postfix/amavis/smtpd[7326]: 4ql0LCJHvGz3J39: client=localhost[]
	Apr 11 04:24:15 mail01 postfix/cleanup[7327]: 4ql0LCJHvGz3J39: message-id=<XACREbkS52aLiD at>
	Apr 11 04:24:16 mail01 postfix/qmgr[20856]: 4ql0LCJHvGz3J39: from=<postmaster at>, size=3301, nrcpt=1 (queue active)
>> 	Apr 11 04:24:16 mail01 postfix/psint/smtpd[7319]: proxy-accept: END-OF-MESSAGE: 250 2.7.0 Ok, discarded, id=06097-01 - INFECTED: Porcupine.Malware.36603.UNOFFICIAL; from=<www-data at> to=<exampleme at> proto=ESMTP helo=<>
	Apr 11 04:24:16 mail01 postfix/psint/smtpd[7319]: disconnect from[] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5

How do I add the virus sender's IP into that " ... INFECTED: ..." Amavisd message ?


More information about the amavis-users mailing list