up vote 0 down vote favorite
share [g+] share [fb]

How do I know if ClamAv is actively running?

I installed it with

sudo aptitude install clamav

But I don't see it anywhere and am not sure if it's actually doing anything.

link|improve this question
96% accept rate
Why exactly do you run clamav? If you're just a desktop linux user, you don't need clamav. – Peltier Sep 18 '09 at 6:58
1  
Alot of Linux users install ClamAV so they can scan files in case it gets emailed to a Windows user. – caliban Sep 18 '09 at 7:19
feedback

3 Answers

up vote 4 down vote accepted

ClamAV is designed to be an on-demand scanner, and will only run when you invoke it to run (which mean you probably won't see any of its processes if you did not manually invoke it). Also, when you installed the clamav package, you only installed the command-line scanner and scanning engine.

If you want to install the full package of ClamAV, I suggest you use this

sudo aptitude install clamav clamav-daemon clamav-freshclam clamtk

A breakdown of what package does what :

  • clamav - the command-line based ClamAV virus scanner and engine
  • clamav-daemon - enables ClamAV to be an on-access scanner, which means it runs automatically without your intervention
  • clamav-freshclam - enables automatic updates for ClamAV
  • clamtk - the GUI frontend for ClamAV

alt text

With all these packages installed, ClamAV should perform like most other AV packages. Like alex said, once you installed these packages, running ps should allow you to see the ClamAV daemon running.

link|improve this answer
Clamav-daemon doesn't do on-access scanning. It just keeps clamav loaded, so that scanning individual files doesn't require loading clamav every time. If you want on-access scans, you need a kernel add-on like Dazuko (dazuko.dnsalias.org/wiki/index.php/Main_Page). There's been work on giving Linux support for stuff like this in recent kernels. It might be working in the latest, but you'll need to read the changelogs to find the tech, and then research how to use it a little. You might also be able to get away with using incron, which lets you run jobs when files are modified – Lee B Sep 18 '09 at 8:53
Ahh, there are also layered filesystem options like ClamFS and AVFS these days. – Lee B Sep 18 '09 at 9:02
feedback
up vote 0 down vote

Try searching for the process associated with ClamAv. You can use top or ps to find it. There's a bit more information about the processes that ClamAV uses in this article; it's a bit old, but maybe it can guide you in the right direction.

link|improve this answer
feedback
up vote 0 down vote

And to test any virus or malware scanner, there's the harmless Eicar Test File.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.