I've put the expetr.yara rule from Kaspersky for the recent notPetya ransomware in my /var/lib/clamav directory. I can I tell if clamav is running it? I see nothing in /var/log/clamav.log. --Mark