[clamav-users] what initiates freshclam?

[Kenneth Porter]

--On Thursday, January 06, 2022 7:51 PM +0000 novpenguincne via 
clamav-users <clamav-users at lists.clamav.net> wrote:

> Mystery solved. I checked for cron jobs but I only looked in
> /var/spool/cron and didn't think to check in /etc/crond.d.

Long ago (before systemd) the Red Hat family stopped using the root crontab 
for periodic system services, because it's not package-friendly. There was 
no way to know which line in the crontab was "owned" by which package, so 
it couldn't be cleaned up when removing a package.

Instead, they replaced that mechanism with /usr/bin/run-parts run from 
/etc/cron.d/0hourly. This allows packages to simply drop their crontab 
services into one of the /etc/cron.* directories.

I now use "ls /etc/cron*" to look for scripts that run periodically. Until 
I learned how to use systemd timer units (which are much more flexible and 
can run in parallel), I put my own scripts in there.

One reason to switch to systemd is that you no longer need to implement a 
random delay in your own script to reduce server load from lots of client 
scripts slamming the server at the top of the hour. See the 
RandomizedDelaySec and FixedRandomDelay options in the timer help.