[clamav-users] Clamdtop not showing activity for ScanOnAccess activity?

Ian clamav at zestysoft.com
Wed Oct 9 20:36:32 EDT 2019

I’m sure I’ve done something wrong, so hopefully I can give enough detail to discover what that is...

Ubuntu 18.04.3 LTS (4.15.0-1040-aws)

Installed packages:
ii  clamav                                0.100.3+dfsg-0ubuntu0.18.04.1      amd64        anti-virus utility for Unix - command-line interface
ii  clamav-base                           0.100.3+dfsg-0ubuntu0.18.04.1      all          anti-virus utility for Unix - base package
ii  clamav-daemon                         0.100.3+dfsg-0ubuntu0.18.04.1      amd64        anti-virus utility for Unix - scanner daemon
ii  clamav-freshclam                      0.100.3+dfsg-0ubuntu0.18.04.1      amd64        anti-virus utility for Unix - virus database update utility
ii  libclamav7:amd64                      0.100.3+dfsg-0ubuntu0.18.04.1      amd64        anti-virus utility for Unix - library

I’ve enabled on access scanning (detect only), changed the user to root and (hopefully) adjusted the socket information to work with these adjustments:

LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup root
LocalSocketMode 666
ScanOnAccess true

ls -la /var/run/clamav/clamd.ctl 
srw-rw-rw- 1 root root 0 Oct  9 21:14 /var/run/clamav/clamd.ctl

Running clamdtop (sudo or otherwise) shows one entry for the daemon running on local.  It correctly displays the version of the engine, db version, and dbtime.

If I use clamdscan, I see plenty of activity and an appropriate cpu utilization in both clamdtop and regular top.

However, if I attempt to access files outside of calling clamdscan, clamdtop remains silent.  Running top in a different window shows clamd using plenty of CPU resources, and I see /tmp/clamav*.tmp folders getting created so I know it’s doing work.

What have I missed?  Apparmor doesn’t seem to be getting in the middle of anything (dmesg and journalctl are silent about clamd) and selinux is disabled.

Here’s my clamd.conf contents:

LocalSocket /var/run/clamav/clamd.ctl
FixStaleSocket true
LocalSocketGroup root
LocalSocketMode 666
#User clamav
ScanMail true
ScanArchive true
ArchiveBlockEncrypted true
MaxDirectoryRecursion 15
FollowDirectorySymlinks false
FollowFileSymlinks false
ReadTimeout 180
MaxThreads 12
MaxConnectionQueueLength 15
LogSyslog false
LogRotate true
LogFacility LOG_LOCAL6
LogClean false
LogVerbose false
PreludeEnable no
PreludeAnalyzerName ClamAV
DatabaseDirectory /var/lib/clamav
OfficialDatabaseOnly false
SelfCheck 3600
Foreground false
Debug false
ScanPE true
MaxEmbeddedPE 10M
ScanOLE2 true
ScanPDF true
ScanHTML true
MaxHTMLNormalize 10M
MaxHTMLNoTags 2M
MaxScriptNormalize 5M
MaxZipTypeRcg 1M
ScanSWF true
DetectBrokenExecutables false
ExitOnOOM false
LeaveTemporaryFiles false
AlgorithmicDetection true
ScanELF true
IdleTimeout 30
CrossFilesystems true
PhishingSignatures true
PhishingScanURLs true
PhishingAlwaysBlockSSLMismatch false
PhishingAlwaysBlockCloak false
PartitionIntersection false
DetectPUA true
ScanPartialMessages false
HeuristicScanPrecedence false
StructuredDataDetection false
CommandReadTimeout 5
SendBufTimeout 200
MaxQueue 100
ExtendedDetectionInfo true
OLE2BlockMacros false
ScanOnAccess true
AllowAllMatchScan true
ForceToDisk false
DisableCertCheck false
DisableCache false
MaxScanSize 100M
MaxFileSize 25M
MaxRecursion 16
MaxFiles 10000
MaxPartitions 50
MaxIconsPE 100
PCREMatchLimit 10000
PCRERecMatchLimit 5000
PCREMaxFileSize 25M
ScanXMLDOCS true
ScanHWP3 true
MaxRecHWP3 16
StreamMaxLength 25M
LogFile /var/log/clamav/clamav.log
LogTime true
LogFileUnlock false
LogFileMaxSize 0
Bytecode true
BytecodeSecurity TrustSigned
BytecodeTimeout 60000
OnAccessMountPath /
OnAccessMountPath /home
OnAccessMountPath /var/log
OnAccessMountPath /var/tmp
OnAccessPrevention false
OnAccessMountPath /tmp

And the custom rules I added for apparmor in local/usr.sbin.clamd:

capability sys_admin,
capability dac_read_search,
/	r,
/**	r,

More information about the clamav-users mailing list