Scanning with ClamAV¶

In this article

• Installation
• Updating Signatures
• Resource Requirements
• Scanning Examples
• Useful Tips

ClamAV is a free, cross‑platform, open‑source antivirus designed to detect trojans, viruses, malware, and other threats. It is most commonly used on servers and mail gateways.

Installation¶

Ubuntu / Debian¶

sudo apt update && sudo apt install -y clamav clamav-daemon

CentOS / RHEL / Fedora¶

For RHEL/CentOS 7 / 8 / 9 (EPEL must be enabled)

sudo yum install -y epel-release
sudo yum install -y clamav clamav-update

sudo dnf install -y clamav clamav-update

Updating Signatures¶

Before first use, be sure to update the virus signature databases.

Standard method (when freshclam is running)¶

sudo freshclam

If you encounter an error ERROR: Can't open /var/lib/clamav/main.cvd: Permission denied or ERROR: Database lock file exists, the clamav-freshclam service may already be running and blocking the update. In that case, use:

sudo systemctl stop clamav-freshclam
sudo freshclam
sudo systemctl start clamav-freshclam

Resource Requirements¶

• RAM: For full scans, at least 1–1.5 GB of free RAM is recommended.
• Swap: If no swap partition or file exists, set it up, especially on VPS with limited memory:

  sudo fallocate -l 2G /swapfile
  sudo chmod 600 /swapfile
  sudo mkswap /swapfile
  sudo swapon /swapfile
  echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
  

Scanning Examples¶

To speed up repeated scans, it is recommended to use clamdscan (runs via the clamd daemon), after starting the service:

sudo systemctl start clamav-daemon
sudo clamdscan -r /folder

Useful Tips¶

• To check if clamd is running:

  sudo systemctl status clamav-daemon
  

• Scanning logs (by default) are located in /var/log/clamav/.
• To schedule regular scans, set up cron:

  # Daily check at 3:30 am
  30 3 * * * /usr/bin/clamscan -r --exclude-dir="^/sys\|^/proc\|^/dev" /home --log=/var/log/clamav/daily_scan.log