ClamAV scans the host for known malware using its signature database. It focuses on the writable, higher-risk directories where malicious files are most likely to appear, rather than the entire filesystem.
Supports: NIST 800-53 SI-3 (Malicious Code Protection).
What you get
Every detected file becomes a critical finding that names the file and the malware signature it matched.
Default coverage
/home, /root, /tmp, /var/tmp, /dev/shm, /opt, /srv, and /var/www.
Options
| Key | Default | Effect |
|---|---|---|
target |
None | A single path to scan, for example / for a full-host scan. |
paths |
The directories above | A list of paths to scan. |
A full-host scan can take a long time on a large server. Consider running it on demand or on a less frequent schedule.
Signature updates
The agent downloads the latest ClamAV signatures each time it starts, and keeps them between restarts. This requires outbound internet access from the agent. If the update fails, the agent logs a warning and continues with the signatures it already has.