Hello,I'm trying to configure clamav on Amazon Linux 2 with the following packages * clamav* clamav-data* clamav-update* clamd I created the /etc/clamd.d/server.conf file with the following content ----------/etc/clamd.d/server.conf----------- LogFile /var/log/clamd.scan LogTime yes LogVerbose yes LogSyslog yes LocalSocket /run/clamd.scan/clamd.sock
User clamscan LocalSocketMode 660 FixStaleSocket yes TCPSocket 3310 TCPAddr 127.0.0.1----------------------------------------- Started the clamav daemon --------------------------------------------- [root@ip-172-31-240-122 ~]# systemctl status clamd@server ● clamd@server.service - clamd scanner (server) daemon Loaded: loaded (/usr/lib/systemd/system/clamd@.service; disabled; vendor preset: disabled) Active: active (running) since Fri 2023-05-26 12:23:40 UTC; 40s ago Docs: man:clamd(8) man:clamd.conf(5) https://www.clamav.net/documents/ Process: 5568 ExecStart=/usr/sbin/clamd -c /etc/clamd.d/%i.conf (code=exited, status=0/SUCCESS) Main PID: 5569 (clamd) CGroup: /system.slice/system-clamd.slice/clamd@server.service └─5569 /usr/sbin/clamd -c /etc/clamd.d/server.conf May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: Mail files support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: OLE2 support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: PDF support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: SWF support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: HTML support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: XMLDOCS support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: HWP3 support enabled. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: Self checking every 600 seconds. May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: Listening daemon: PID: 5569 May 26 12:23:40 ip-172-31-240-122.ec2.internal clamd[5569]: MaxQueue set to: 100 [root@ip-172-31-240-122 ~]#--------------------------------------------- The Clamav onaccess configuration in the /etc/clamd.d/scan.conf file ------------/etc/clamd.d/scan.conf---------------LogSyslog yes LocalSocket /run/clamd.scan/clamd.sock VirusEvent echo "VIRUS ALERT: $CLAM_VIRUSEVENT_VIRUSNAME in $CLAM_VIRUSEVENT_FILENAME" >> /tmp/clamonacc.log User clamscan OnAccessIncludePath /tests OnAccessExcludeUname clamav ------------------------------------ and started clamav-clamonacc --------------------------------------------- [root@ip-172-31-240-122 bin]# systemctl status clamav-clamonacc ● clamav-clamonacc.service - ClamAV On-Access Scanner Loaded: loaded (/usr/lib/systemd/system/clamav-clamonacc.service; disabled; vendor preset: disabled) Active: active (running) since Fri 2023-05-26 12:51:59 UTC; 19s ago Docs: man:clamonacc(8) man:clamd.conf(5) https://docs.clamav.net/ Main PID: 24298 (clamonacc) CGroup: /system.slice/clamav-clamonacc.service └─24298 /usr/sbin/clamonacc -F --config-file=/etc/clamd.d/scan.conf May 26 12:51:59 ip-172-31-240-122.ec2.internal systemd[1]: Started ClamAV On-Access Scanner. May 26 12:51:59 ip-172-31-240-122.ec2.internal clamonacc[24298]: ClamInotif: watching '/tests' (and all sub-directories) [root@ip-172-31-240-122 bin]# --------------------------------------------- I created the /tests directory and granted permissions -------------------------------------------mkdir /tests chmod -R 777 /tests chown -R clamscan: /tests------------------------------------------- I downloaded eicar to test ------------------------------------------- wget https://secure.eicar.org/eicar.com------------------------------------------- in the logs it generates a lot of message I believe to be verification and kills the process -------------------------------------------May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: /tests/eicar.com.1: Win.Test.EICAR_HDB-1 FOUND May 26 13:09:53 ip-172-31-240-122.ec2.internal clamonacc[31408]: *** buffer overflow detected ***: /usr/sbin/clamonacc terminated May 26 13:09:53 ip-172-31-240-122.ec2.internal systemd[1]: clamav-clamonacc.service: main process exited, code=killed, status=6/ABRT May 26 13:09:53 ip-172-31-240-122.ec2.internal systemd[1]: Unit clamav-clamonacc.service entered failed state. May 26 13:09:53 ip-172-31-240-122.ec2.internal systemd[1]: clamav-clamonacc.service failed.------------------------------------------- Versions:------------------------------------------- [root@ip-172-31-240-122 tests]# clamd -V ClamAV 0.103.8/26825/Mon Feb 27 08:24:38 2023 [root@ip-172-31-240-122 tests]# clamonacc -V ClamAV 0.103.8/26825/Mon Feb 27 08:24:38 2023 [root@ip-172-31-240-122 tests]#------------------------------------------- Let me know if I'm doing something wrong? Thanks
_______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat
