Good morning Tsutomu, Al is quite correct. clamd and clamdscan maintain no memory of what has been scanned before.
In your ordinary use case, you simply run clamdscan over whatever you want to scan. You can exclude specific directories in your configuration if you want to point clamdscan at a high level directory to scan many items. In truth, I've never tried accessing the files as they were scanned, but I do not believe that there any reason why the files would be locked by ClamAV except in the following case. On newer versions of Linux that have been built with CONFIG_FANOTIFY=y enabled, you can configure clamd to monitor directories. An additional option may be enabled that we call "OnAccessPrevention" can intentionally block access to the file until it has been scanned and will deny access if the file is flagged. OnAccessPrevention requires your kernel has been built with CONFIG_FANOTIFY_ACCESS_PERMISSION=y. If you're interested in trying this out, please read http://blog.clamav.net/2016/03/configuring-on-access-scanning-in-clamav.html Sadly, OnAccess scanning and prevention only exist for Linux at this time. Micah Snyder ClamAV Development Talos Cisco Systems, Inc. On Mar 19, 2018, at 10:47 AM, Tsutomu Oyamada <oyam...@promark-inc.com<mailto:oyam...@promark-inc.com>> wrote: Thank you so much. Your advice was very helpful. I would also like to wait for a message from the developer. On Thu, 15 Mar 2018 23:13:09 -0700 Al Varnell <alvarn...@mac.com<mailto:alvarn...@mac.com>> wrote: I believe the developers are hard at work planning for the future this week, so they can probably can give you better answers than I later on. I suspect some of this may be platform specific, so my answers are based on my macOS experience. clamd scans every file that clamdscan tells it to, so something else needs to keep track of what's new or changed and notify clamdscan to tell clamd to scan them. So that requires tapping into the file system to determine changes in the area of interest. I've never had an issue with using a file while it's being processed by ClamAV, but scans normally take place very rapidly, so I my not have noticed it being locked. Sent from my iPad -Al- On Mar 15, 2018, at 1:12 AM, Tsutomu Oyamada <oyam...@promark-inc.com<mailto:oyam...@promark-inc.com>> wrote: I have two question about the clamdscan; 1) Does the clamd skip scanning the files which are scanned before? I want to know if the clamd remember which files are scanned, and skip them when the scan is performed again. 2) Is there any case that a file is locked by the clamd (user cannot use that file) during that is scanned? T.O _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net<mailto:clamav-users@lists.clamav.net> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net<mailto:clamav-users@lists.clamav.net> http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
