[clamav-users] OnAccessExtraScanning not working?

[Micah Snyder (micasnyd)]

Hey Nick, Ged,

Looks like we forgot to update the ticket here.  

OnAccessExtraScanning *should* be working now.  On-access scanning received a major overhaul in 0.102.  It used to be that it was a ClamD feature.  The threading model in ClamD is already complex. When ClamD had on-access and extra-scanning enabled it leaked thread data and was disabled for that reason.  In 0.102 the on-access feature was completely removed from ClamD and re-written in a new tool called ClamOnAcc which is a daemon and client to the ClamD scanning server daemon. As far as I know, there are no memory leak issues now with extra-scanning in ClamOnAcc.

We have another user, Hanspeter, who is also concerned about EICAR file creations when using ClamOnAcc with OnAccessExtraScanning enabled. He created this ticket for help with testing to validate that ClamOnAcc reliably detects EICAR file creates: https://bugzilla.clamav.net/show_bug.cgi?id=12667

Can you confirm if the file is detected after download when you `touch` it?

-Micah

> -----Original Message-----
> From: clamav-users <clamav-users-bounces at lists.clamav.net> On Behalf Of
> Nick via clamav-users
> Sent: Wednesday, February 3, 2021 6:30 AM
> To: ClamAV users ML <clamav-users at lists.clamav.net>
> Cc: Nick <mr.nick.hall at protonmail.com>; G.W. Haywood
> <clamav at jubileegroup.co.uk>
> Subject: Re: [clamav-users] OnAccessExtraScanning not working?
> 
> Thanks for the quick response Ged. Ok good to know the answer. I'll try and
> hack something with inotifywait for now.
> 
> Nick
> 
> 
> 
> 
> ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> On Tuesday, 2 February 2021 12:11, G.W. Haywood via clamav-users <clamav-
> users at lists.clamav.net> wrote:
> 
> > Hi there,
> >
> > On Tue, 2 Feb 2021, Nick via clamav-users wrote:
> >
> > > New to clamav so please forgive me if I've missed something obvious.
> >
> > There's lots to find if you dig deep enough for long enough. :)
> >
> > > ... I enabled OnAccessExtraScanning as man clamd.conf says this
> > > "Toggles extra scanning and notifications when a file or directory
> > > is created or moved." Unfortunately when the eicar file is created
> > > (by using wget to download it) I don't see anything happen. I did
> > > read this feature was taken out due to a memory leak. Is it still
> > > removed or am I missing something else?
> >
> > https://bugzilla.clamav.net/show_bug.cgi?id=12048
> >
> > After three years of no movement on this, I think there's a case for
> > updating the 'man' page to reflect the status quo.
> >
> > ----------------------------------------------------------------------
> > ----------------------------------------------------------------------
> > ---------------------------------
> >
> > 73,
> > Ged.
> >
> > clamav-users mailing list
> > clamav-users at lists.clamav.net
> > https://lists.clamav.net/mailman/listinfo/clamav-users
> >
> > Help us build a comprehensive ClamAV guide:
> > https://github.com/vrtadmin/clamav-faq
> >
> > http://www.clamav.net/contact.html#ml
> 
> 
> 
> _______________________________________________
> 
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
> 
> 
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
> 
> http://www.clamav.net/contact.html#ml