Thu Mar 26 15:33:36 2020 -> /usr/bin/sudo: Can't open file or directory ERROR Thu Mar 26 15:33:32 2020 -> /var/snap/microk8s/1247/certs/front-proxy-client.crt: Can't open file or directory ERROR We can see that once started, it immediatly starts filling with garbage access errors. Logging was configured in /var/log/clamav/clamav.log. └─1789 /usr/bin/clamonacc -F -log=/var/log/clamav/access.log On Access Observations On Access Logging Loaded: loaded (/etc/systemd/system/rvice enabled vendor preset: enabled)Īctive: active (running) since Thu 15:33:25 CDT 41min agoĬGroup: /system.slice/rvice Add it to a new file /etc/systemd/system/rvice. Process: 32759 ExecStartPre=/bin/chown clamav /run/clamav (code=exited, status=0/SUCCESS)ĬGroup: /system.slice/rvice Process: 32756 ExecStartPre=/bin/mkdir /run/clamav (code=exited, status=1/FAILURE) Loaded: loaded (/lib/systemd/system/rvice enabled vendor preset: enabled)ĭrop-In: /etc/systemd/system/Īctive: active (running) since Thu 15:32:22 CDT 40min ago

rvice - Clam AntiVirus userspace daemon.

usr/bin/notify-send -i security-low 'Virus signature(s) found ' ' $INFECTED_SUMMARY ' done fi Rm ' $SUMMARY_FILE ' if ] then # Send the alert to systemd logger if exist if ] then echo 'Virus signature found - $INFECTED_SUMMARY ' | /usr/bin/systemd-cat -t clamav -p emergįi # Send an alert to all graphical users. INFECTED_SUMMARY= `cat $SUMMARY_FILE | grep Infected ` Sudo clamdscan -log ' $LOG ' -infected -multiscan -fdpass ' $TARGET ' > ' $SUMMARY_FILE ' #!/bin/bash export LOG= '/var/log/clamav/scan.log ' export TARGET= '/ ' export SUMMARY_FILE= `mktemp ` export SCAN_STATUSĮcho '- SCAN START - ' > ' $LOG ' echo 'Running scan on `date ` ' > ' $LOG ' This is located in /etc/clamav/nf ExtendedDetectionInfo yesĪdd a notifitcation script to /etc/clamav/detected.sh and make sure it's executable with a chmod +x

Very verbose logging of access errors (tens of thousands of lines per hour).

I identified two large issues with on-access scanning:

In order to facilitate this, I decided to create a system daemon to run the clamonacc script automatically. The ClamAV daemon does not start on-access scanning automatically. Additionally, ClamAV can be configured to interact with potential vulnerabilities directly - however I would not personally be comfortable with such an implementation on my systems, and have opted to skip this.

My goal was to log and notify potential vulnerabilities. I attempted to configure the ClamAV daemon to scan accessed files. $ sudo apt-get install clamav clamscan clamav-daemon On-Access ScanningĬlamAV comes with on-access scanning.

Clamav gui for windows