Hello,
Hope this clearify it more.
I use following curl version:
[erirhe1d@gglvboft001 tmp]$ curl -V
curl 7.68.0-DEV (x86_64-unknown-linux-gnu) libcurl/7.68.0-DEV OpenSSL/1.0.2k-fips zlib/1.2.7 libssh2/1.8.0
Release-Date: [unreleased]
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: AsynchDNS HTTPS-proxy Largefile libz NTLM NTLM_WB SSL UnixSockets
My /etc/clamd.d/scan.conf (comment stripped)
LogFile /var/log/clamav/clamd.scan.log
LogFileMaxSize 2M
LogTime yes
LogSyslog yes
LogRotate yes
ExtendedDetectionInfo yes
PidFile /var/run/clamd.scan/clamd.pid
TemporaryDirectory /tmp
DatabaseDirectory /var/lib/clamav
LocalSocket /var/run/clamd.scan/clamd.sock
LocalSocketGroup virusgroup
LocalSocketMode 660
FixStaleSocket yes
ExcludePath ^/proc/
ExcludePath ^/sys/
User clamscan
AlertBrokenExecutables yes
AlertEncrypted yes
AlertEncryptedArchive yes
AlertEncryptedDoc yes
ScanELF yes
ScanHTML yes
OnAccessIncludePath /bin
OnAccessIncludePath /sbin
OnAccessIncludePath /boot
OnAccessIncludePath /data
OnAccessIncludePath /etc
OnAccessIncludePath /lib
OnAccessIncludePath /lib64
OnAccessIncludePath /srv
OnAccessIncludePath /tmp
OnAccessIncludePath /usr
OnAccessIncludePath /var
OnAccessExcludePath /proc
OnAccessExcludePath /sys
OnAccessExtraScanning yes
OnAccessExcludeRootUID yes
OnAccessExcludeUID 994
OnAccessExcludeUname clamav
OnAccessExcludeUname clamscan
Bytecode yes
File: /var/log/messages
Jul 7 09:52:14 gglvboft001 systemd: Starting clamd scanner (scan) daemon...
Jul 7 09:52:14 gglvboft001 clamd[13246]: Received 0 file descriptor(s) from systemd.
Jul 7 09:52:14 gglvboft001 clamd[13246]: clamd daemon 0.102.3 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Jul 7 09:52:14 gglvboft001 clamd[13246]: Running as user clamscan (UID 994, GID 988)
Jul 7 09:52:14 gglvboft001 clamd[13246]: Log file size limited to 2097152 bytes.
Jul 7 09:52:14 gglvboft001 clamd[13246]: Reading databases from /var/lib/clamav
Jul 7 09:52:14 gglvboft001 clamd[13246]: Not loading PUA signatures.
Jul 7 09:52:14 gglvboft001 clamd[13246]: Bytecode: Security mode set to "TrustSigned".
Jul 7 09:52:26 gglvboft001 clamd[13246]: Loaded 7752884 signatures.
Jul 7 09:52:28 gglvboft001 clamd[13246]: LOCAL: Unix socket file /var/run/clamd.scan/clamd.sock
Jul 7 09:52:28 gglvboft001 clamd[13246]: LOCAL: Setting connection queue length to 200
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: Global time limit set to 120000 milliseconds.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: Global size limit set to 104857600 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: File size limit set to 26214400 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: Recursion level limit set to 16.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: Files limit set to 10000.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxEmbeddedPE limit set to 10485760 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxHTMLNormalize limit set to 10485760 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxHTMLNoTags limit set to 2097152 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxScriptNormalize limit set to 5242880 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxZipTypeRcg limit set to 1048576 bytes.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxPartitions limit set to 50.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxIconsPE limit set to 100.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: MaxRecHWP3 limit set to 16.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: PCREMatchLimit limit set to 100000.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: PCRERecMatchLimit limit set to 2000.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Limits: PCREMaxFileSize limit set to 26214400.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Archive support enabled.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Alerting of encrypted archives _and_ documents enabled.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Alerting of encrypted archives _and_ documents enabled.
Jul 7 09:52:28 gglvboft001 clamd[13259]: Alerting of encrypted documents enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: AlertExceedsMax heuristic detection disabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: Heuristic alerts enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: Portable Executable support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: ELF support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: Alerting on broken executables enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: Mail files support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: OLE2 support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: PDF support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: SWF support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: HTML support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: XMLDOCS support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: HWP3 support enabled.
Jul 7 09:52:29 gglvboft001 clamd[13259]: Self checking every 600 seconds.
Jul 7 09:52:31 gglvboft001 systemd: Started clamd scanner (scan) daemon.
Jul 7 09:52:41 gglvboft001 systemd: Started Clam AntiVirus userspace daemon for OnAccess Scanning.
Jul 7 09:52:41 gglvboft001 clamonacc: ClamInotif: watching '/bin' (and all sub-directories)
Jul 7 09:52:41 gglvboft001 clamonacc: ClamInotif: watching '/sbin' (and all sub-directories)
Jul 7 09:52:41 gglvboft001 clamonacc: ClamInotif: watching '/boot' (and all sub-directories)
Jul 7 09:52:41 gglvboft001 clamonacc: ClamInotif: watching '/data' (and all sub-directories)
Jul 7 09:52:42 gglvboft001 clamonacc: ClamInotif: watching '/etc' (and all sub-directories)
Jul 7 09:52:42 gglvboft001 clamonacc: ClamInotif: watching '/lib' (and all sub-directories)
Jul 7 09:52:42 gglvboft001 clamonacc: ClamInotif: watching '/lib64' (and all sub-directories)
Jul 7 09:52:42 gglvboft001 clamonacc: ClamInotif: watching '/srv' (and all sub-directories)
Jul 7 09:52:42 gglvboft001 clamonacc: ClamInotif: watching '/tmp' (and all sub-directories)
Jul 7 09:52:43 gglvboft001 clamonacc: ClamInotif: watching '/usr' (and all sub-directories)
Jul 7 09:52:43 gglvboft001 clamonacc: ClamInotif: watching '/var' (and all sub-directories)
Jul 7 09:55:27 gglvboft001 su: (to root) erirhe1d on pts/0
My test:
[erirhe1d@gglvboft001 tmp]$ date
Tue Jul 7 09:54:39 CEST 2020
[erirhe1d@gglvboft001 tmp]$ ls -lia eicar.com
118 -rw-r--r--. 1 erirhe1d erirhe1d 68 Jul 3 09:42 eicar.com
[erirhe1d@gglvboft001 tmp]$ cp eicar.com eicar1.com
[erirhe1d@gglvboft001 tmp]$ cat eicar.com
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*[erirhe1d@gglvboft001 tmp]$
[erirhe1d@gglvboft001 tmp]$ more eicar.com
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
[erirhe1d@gglvboft001 tmp]$
[erirhe1d@gglvboft001 tmp]$ date
Tue Jul 7 09:55:20 CEST 2020
[erirhe1d@gglvboft001 tmp]$
No warning in /var/log/messages ?????
Now commented out "OnAccessIncludePath" and set "OnAccessMountPath" in /etc/clamd.d/scan.conf.
Restarted clamd@scan and clamonacc.
OnAccessMountPath /boot
OnAccessMountPath /
OnAccessMountPath /srv
OnAccessMountPath /var
OnAccessMountPath /tmp
OnAccessMountPath /data
OnAccessMountPath /var/log/audit
/var/log/messages:
Jul 7 10:02:06 gglvboft001 systemd: Starting clamd scanner (scan) daemon...
Jul 7 10:02:06 gglvboft001 clamd[13861]: Received 0 file descriptor(s) from systemd.
Jul 7 10:02:06 gglvboft001 clamd[13861]: clamd daemon 0.102.3 (OS: linux-gnu, ARCH: x86_64, CPU: x86_64)
Jul 7 10:02:06 gglvboft001 clamd[13861]: Running as user clamscan (UID 994, GID 988)
Jul 7 10:02:06 gglvboft001 clamd[13861]: Log file size limited to 2097152 bytes.
Jul 7 10:02:06 gglvboft001 clamd[13861]: Reading databases from /var/lib/clamav
Jul 7 10:02:06 gglvboft001 clamd[13861]: Not loading PUA signatures.
Jul 7 10:02:06 gglvboft001 clamd[13861]: Bytecode: Security mode set to "TrustSigned".
Jul 7 10:02:18 gglvboft001 clamd[13861]: Loaded 7752884 signatures.
Jul 7 10:02:21 gglvboft001 clamd[13861]: LOCAL: Unix socket file /var/run/clamd.scan/clamd.sock
Jul 7 10:02:21 gglvboft001 clamd[13861]: LOCAL: Setting connection queue length to 200
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: Global time limit set to 120000 milliseconds.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: Global size limit set to 104857600 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: File size limit set to 26214400 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: Recursion level limit set to 16.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: Files limit set to 10000.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxEmbeddedPE limit set to 10485760 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxHTMLNormalize limit set to 10485760 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxHTMLNoTags limit set to 2097152 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxScriptNormalize limit set to 5242880 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxZipTypeRcg limit set to 1048576 bytes.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxPartitions limit set to 50.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxIconsPE limit set to 100.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: MaxRecHWP3 limit set to 16.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: PCREMatchLimit limit set to 100000.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: PCRERecMatchLimit limit set to 2000.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Limits: PCREMaxFileSize limit set to 26214400.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Archive support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Alerting of encrypted archives _and_ documents enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Alerting of encrypted archives _and_ documents enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Alerting of encrypted documents enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: AlertExceedsMax heuristic detection disabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Heuristic alerts enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Portable Executable support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: ELF support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Alerting on broken executables enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Mail files support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: OLE2 support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: PDF support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: SWF support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: HTML support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: XMLDOCS support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: HWP3 support enabled.
Jul 7 10:02:21 gglvboft001 clamd[13874]: Self checking every 600 seconds.
Jul 7 10:02:23 gglvboft001 systemd: Started clamd scanner (scan) daemon.
Jul 7 10:02:33 gglvboft001 systemd: Started Clam AntiVirus userspace daemon for OnAccess Scanning.
Jul 7 10:02:59 gglvboft001 clamd[13874]: lstat() failed on: /var/spool/postfix/maildrop/DF960218984
Jul 7 10:02:59 gglvboft001 clamd[13874]: lstat() failed on: /var/spool/postfix/incoming/E5C134E
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13774 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13943 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13943 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13943 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13943 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13943 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:02:59 gglvboft001 clamonacc: ClamMisc: $/proc/13943 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:00 gglvboft001 clamd[13874]: lstat() failed on: /var/spool/postfix/maildrop/DF960218984
Jul 7 10:03:25 gglvboft001 clamd[13874]: /tmp/eicar.com: Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f:68) FOUND
Jul 7 10:03:25 gglvboft001 clamonacc: /tmp/eicar.com: Win.Test.EICAR_HDB-1 FOUND
Jul 7 10:03:25 gglvboft001 clamd[13874]: /tmp/eicar2.com: Win.Test.EICAR_HDB-1(44d88612fea8a8f36de82e1278abb02f: 68) FOUND
Jul 7 10:03:25 gglvboft001 clamonacc: /tmp/eicar2.com: Win.Test.EICAR_HDB-1 FOUND
Jul 7 10:03:41 gglvboft001 su: (to root) erirhe1d on pts/0
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13990 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13992 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13992 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/13998 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14003 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14003 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14003 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14003 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14003 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14003 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
Jul 7 10:03:41 gglvboft001 clamonacc: ClamMisc: $/proc/14006 vanished before UIDs could be excluded; scanning anyway
My test:
[erirhe1d@gglvboft001 tmp]$ date
Tue Jul 7 10:03:15 CEST 2020
[erirhe1d@gglvboft001 tmp]$ cp eicar.com eicar2.com
[erirhe1d@gglvboft001 tmp]$ date
Tue Jul 7 10:03:36 CEST 2020
My disks:
[root@gglvboft001 ~]# lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 20G 0 disk
†€sda1 8:1 0 512M 0 part /boot
„€sda2 8:2 0 19.5G 0 part
†€system-lv--root 253:0 0 8G 0 lvm /
†€system-lv--swap 253:1 0 2G 0 lvm [SWAP]
†€system-lv--srv 253:4 0 2G 0 lvm /srv
†€system-lv--var 253:5 0 4G 0 lvm /var
„€system-lv--tmp 253:6 0 2G 0 lvm /tmp
sdb 8:16 0 100G 0 disk
„€sdb1 8:17 0 100G 0 part
†€datavg-lv--data 253:2 0 4G 0 lvm /data
„€datavg-lv--audit 253:3 0 1G 0 lvm /var/log/audit
[erirhe1d@gglvboft001 tmp]$
Met vriendelijke groet,
Eric van Rheenen
Linux beheer
Raadhuisplein 10, 9751AN Haren
E-Mail:
Eric.van.Rheenen@groningen.nl
Ericvan.Rheenen@ts.fujitsu.com
Telefoon: +31 (0)6 1640 2686