0

In this thread it is discussed how to log a scan by ClamAV. However, the suggestions are only for logging one-off scans triggered from command line.

My situation is that I'm working in a setting where we have to comply with certain rules set forth by credit card companies etc. where two of the requirements are that a) we need to have scheduled, automatic AV scanning enabled, and b) we need to keep log files for at least one year.

I'm currently running ClamAV 0.97.8/18695 on Ubuntu 13.10 (upgraded all the way from 10.10) and the ClamTK GUI v5.05

I've defined daily scan (as well as daily update of signatures/AV definitions), but I cannot find any logs (my first guess was under /var/log/ ). Also, I can't find any clamscan config file where to define such things as logging.

Does anyone have ideas on how to enable automatic logging, and is there a major difference in the installation/config depending on whether ClamAV was installed with or without the ClamTK option? (I installed from Synaptic by selecting ClamTK and allowing apt to resolve dependencies/include what was needed, then I manually upgraded the GUI later from http://code.google.com/p/clamtk/ ).

Also, if anybody can answer how the scheduled of ClamTK is working, I'd appreciate it very much (I do realise it's a separate question, really). Grep'ing in /etc/cron./ doesn't show any hits on 'clam', so I wonder if ClamTK is using its own, custom scheduler or what is going on under the bonnet.

Community
  • 1
alfs
  • 33

1 Answers1

3

A couple of things:

1) ClamTk does not take any arguments like a commandline program would. Anything added after "clamtk" is assumed to be a file or directory for scanning.

2) ClamTk uses crontab for scheduling. Open a terminal window and type "crontab -l", and you'll see what you have scheduled. This should also appear in the GUI.

Hope this helps, Dave M

Dave M
  • 86