Freshclam

Freshclam updates the virus definitions. The database version is checked by a DNS query to current.cvd.clamav.net. The clamav.net DNS server replies with all the information (e.g., latest database version and address of a mirror to download the last definitions) in the TXT records.

Two files make up the virus database:

main.cvd: Contains most virus definitions (about 58,000 signatures)
daily.cvd: Contains the latest virus definitions (about 2,000 signatures)

The databases are signed with the GNU Multiple Precision (GMP) algorithm to ensure file integrity. Use sigtool (provided with ClamAV) to verify the signature manually:

[julien@asus ˜]$ sigtool -i
Build time: 09 Jun 2006 22-19 +0200
Version: 39
# of signatures: 58116
Functionality level: 8
Builder: tkojm
MD5: a9a400e70dcbfe2c9e11d78416e1c0cc
Digital signature: 0s12V8OxLWO95fNNv+kTxj7CEWBW/1TKOGC7G4RelhogruBYw8dJeIX2+yhxe
x/XsLohxoEuXxC2CaFXiiTbrbvpK2USIxkpn53n6LYVV6jKgkP5sa08MdJE7cl29H1slfCrdaevBUZ1Z
/UefkRnV6p3iQVpDPsBwqFRbrem33b
Verification OK

sigtool can also display the list of signatures:

[julien@asus ˜]$ sigtool -i/var/lib/clamav/main.cvd| less
[...]
Ailbone.1536.B
Ailbone.1536
Trojan.AIMSpammer
AIM-Xtreme
[...]

Freshclam can run interactively or as a daemon. It uses the configuration file /etc/freshclam.conf. The main options are:

DatabaseOwner: All the ClamAV programs (Freshclam, Clamscan, clamd, clamdscan) run as user clamav by default. If you want to run these tools as another user, it is necessary to change this field to the new username.
DatabaseDirectory: The two database files take less than 6 MB; the default path is usually the one to use.
DatabaseMirror

How to Run Freshclam

It is possible to run Freshclam with different options from /etc/freshclam.conf. The main command-line arguments are:

--datadir=FOLDER: Saves the new database to FOLDER. This overrides the DatabaseDirectory option. FOLDER must be writable for the clamav user unless it is explicitly running as a different user.
-uUSER: Runs Freshclam as user USER instead of clamav. Use this argument to scan files unavailable to the default user clamav.
-d: Runs Freshclam as a daemon. It is recommended to add Freshclam as a daemon in the startup scripts. To do so, see the next section, "Examples of Commands for Freshclam."
-p FILE: Saves the daemon's PID file to FILE. This argument makes sense only if the -d argument is also used.
- c n: Checks the database version n times a day. This argument makes sense only if the -d argument is used.
--on-error-execute=COMMAND and --on-outdated-execute=COMMAND: Executes COMMAND when the database cannot be updated or is out of date. These arguments overwrite OnErrorExecute and OnOutdatedExecute. See "Examples of Commands for Freshclam."

To run Freshclam interactively as the current user, type:

[julien@asus ˜]$ freshclam -ujulien
Password:
ClamAV update process started at Fri Jun 30 11:39:31 2006
main.cvd is up to date (version: 39, sigs: 58116, f-level: 8, builder: tkojm)
daily.cvd is up to date (version: 1578, sigs: 2615, f-level: 8, builder: ccordes)

To run Freshclam as a daemon in the background with syslog logs in case of errors and 24 database checks a day, use the following:

[julien@asus ˜]$ freshclam -d -p /var/run/freshclam.pid --on-error- execute="/us
r/bin/logger -i -t freshclam -p daemon.alert 'UPDATE ERROR' " -c24
[julien@asus ˜]$

Examples of Commands for Freshclam

Here are some of commands that could be run in case of update error or if the database is out of date:

Logging commands

A simplistic way of logging errors is to write the text to a file in /var/log:

cat "Update Error" > /var/log/freshclam.errors

A better solution is to use the syslog logger; for example, the command:

logger -i -t freshclam -p daemon.alert "Update Error"

adds the following line to /var/log/syslog:

Jun 30 14:09:52 asus freshclam[12433]: Update Error

Email commands

There are several tools to send emails with the command line on Linux. One of them is nail:

echo -e "The clamav database update failed on $HOSTNAME on 'date +%D'
at date +%r'.\nPlease run 'freshclam' locally." |nail -s
"freshclam update error" -r freshclam@domain.net admin@domain.net

This command sends an email from freshclam@domain.net to admin@domain.net with the subject "freshclam update error" and the body:

The clamav database update failed on xxx.domain.net on 06/30/06 at 11:14:47 PM.
 Please run 'freshclam' locally.

You can run several commands when you call freshclam:

[julien@asus ˜]$ freshclam -d -p /var/run/freshclam.pid --on-error-
execute="/usr/bin/logger-i -t freshclam -p daemon.alert 'UPDATE ERROR';
 echo -e \"The clamav database update failed on $HOSTNAME on 'date +%D'
at date +%r'.\nPlease run 'freshclam' locally.\" |nail -s
"freshclam update error" -r freshclam@domain.netadmin@domain.net" -c 24

Freshclam should be started automatically with the computer. Most ClamAV installations on Linux install the script /etc/init.d/freshclam to the system. You can check whether the script is launched automatically when the computer starts:

[julien@asus ˜]$ chkconfig --list|grep freshclam
freshclam       0:off   1:off   2:on    3:on    4:on    5:on    6:off