Some quick background: I have an Ubuntu-based file server in a mixed Linux/Windows (unfortunately mostly Windows) environment. Wanting to mitigate the risk of the file server becoming a vector for viruses spreading through my network, I've installed ClamAV daemon and scheduled clamdscan to run nightly, checking all the files that are served out to the network. This scan takes just over 2 hours to scan the ~350GB of files (versus 4 hours when I used the clamscan tool instead).
However, it's become a depressingly common phenomenon to see this in the nightly report cron faithfully e-mails to me:
--------------------------------------
ERROR: Communication error
----------- SCAN SUMMARY -----------
Infected files: 0
Time: 1802.243 sec (30 m 2 s)
Nothing in any logs sheds any light on what actually happened (although briefly I thought it was freshclam updating the virus database, which clamd then of course re-reads, however this correlation has vanished without any hint of a causal relationship; just to be sure, however, there remains a forced update of the virus database cron'd to run about 30 minutes before the scan starts), just vague references to a "communication error".
Without having any basis to even begin tracking down the cause of this error, I'm mostly looking right now for a way to continue to scan despite the error. I really don't want to just re-start the 2-hour scan again -- most often this seems to occur at the 1-hour mark -- but neither am I happy with just letting a failed scan be until the next nightly scan, especially since it once went 3 consecutive days not getting past the first hour!
Is there any way to get clamdscan to continue to scan files after an error on one (ideally retrying the file it failed on, of course)? If not, are there alternative tools I could use, either ones that use the ClamAV daemon or alternative virus scanners?
