Clamav

Clamav is an open source antivirus engine. It have been used for virus scanning engine in a lot of project, e.g. email scanning, web proxy scanning. This post will help you go through some simple steps to install the clamav in your system.

The installation is ready for use with squidclamav or you may reference it for general usage.
OS: Slackware 13.37
Software: clamav-0.97.3

Pre-installation

• Add uid & gid for clamav

  > groupadd -g  clamav
  > useradd -u  -g  -d /usr/local/clamav -s /bin/false -c 'Clam AntiVirus' clamav
  

Installation

> ./configure --prefix=/usr/local/clamav
> make
> make install
> mkdir -p /usr/local/clamav/var/log
> mkdir -p /usr/local/clamav/var/run
> chown -R clamav:clamav /usr/local/clamav/var

Configuration

• file: /usr/local/clamav/etc/clamd.conf (suggested options)

  Example # uncomment it
  LogFile /usr/local/clamava/var/log/clamd.log
  PidFile /usr/local/clamav/var/run/clamd.pid
  LogFileMaxSize 0
  LogTime yes
  LocalSocket /usr/local/clamav/var/run/clamd.socket
  #DatabaseDirectory /usr/local/clamav/share/clamav # default location for this installation
  

• file:/usr/local/clamav/etc/freshclam.conf (suggested options)

  Example # uncomment it
  UpdateLogFile /usr/local/clamav/var/log/freshclam.log
  PidFile /usr/local/clamav/var/run/freshclam.pid
  LogFileMaxSize 0
  LogTime yes
  Checks 96 # check every 15 mins
  DatabaseMirror db.[your national code].clamav.net
  

Post installation

• Rotate the log, create the file below and modify it to suit your site
• /etc/logrotate.d/clamav

  /usr/local/clamav/var/log/clamd.log {
       rotate 12
       weekly
       compress
       delaycompress
       create 640 root root
       postrotate
       kill -HUP `cat /usr/local/clamav/var/run/clamd.pid`
       endscript
  }
  /usr/local/clamav/var/log/freshclam.log {
       rotate 12
       weekly
       compress
       delaycompress
       create 640 clamav clamav
       postrotate
       kill -HUP `cat /usr/local/clamav/var/run/freshclam.pid`
       endscript
  }
  

Running the daemon

You may place the following lines into /etc/rc.d/rc.local and let the system activate the daemon when boot up.

/usr/local/clamav/sbin/clamd
/usr/local/clamav/bin/freshclam -d