Provided by: clamav-daemon_0.97.3+dfsg-2.1ubuntu1_i386 bug


       clamd - an anti-virus daemon


       clamd [options]


       The  daemon  listens for incoming connections on Unix and/or TCP socket
       and scans files or directories on demand. It  reads  the  configuration
       from /etc/clamav/clamd.conf


       It's recommended to prefix clamd commands with the letter z (eg. zSCAN)
       to indicate that the command will be delimited by a NULL character  and
       that  clamd should continue reading command data until a NULL character
       is read. The null delimiter assures that the complete command  and  its
       entire  argument  will  be processed as a single command. Alternatively
       commands may be prefixed with the  letter  n  (e.g.  nSCAN)  to  use  a
       newline  character  as  the  delimiter.  Clamd  replies will honour the
       requested terminator in turn.  If clamd doesn't recognize the  command,
       or the command doesn't follow the requirements specified below, it will
       reply with an error message, and close the connection.

       Clamd recognizes the following commands:

       PING   Check the server's state. It should reply with "PONG".

              Print program and database versions.

       RELOAD Reload the virus databases.

              Perform a clean exit.

       SCAN file/directory
              Scan a file or a directory (recursively)  with  archive  support
              enabled  (if  not  disabled  in  clamd.conf).  A  full  path  is

       CONTSCAN file/directory
              Scan  file  or  directory  (recursively)  with  archive  support
              enabled and don't stop the scanning when a virus is found.

       MULTISCAN file/directory
              Scan  file  in  a  standard  way or scan directory (recursively)
              using multiple threads (to  make  the  scanning  faster  on  SMP

              It is mandatory to prefix this command with n or z.

              Scan  a  stream  of data. The stream is sent to clamd in chunks,
              after INSTREAM, on the same socket  on  which  the  command  was
              sent.    This  avoids  the  overhead  of  establishing  new  TCP
              connections and problems with NAT. The format of the  chunk  is:
              '<length><data>'  where  <length>  is  the size of the following
              data in bytes expressed as a 4 byte unsigned integer in  network
              byte  order  and  <data>  is  the  actual  chunk.  Streaming  is
              terminated by sending a zero-length chunk. Note: do  not  exceed
              StreamMaxLength  as  defined in clamd.conf, otherwise clamd will
              reply  with  INSTREAM  size  limit  exceeded   and   close   the

       FILDES It  is  mandatory  to  newline terminate this command, or prefix
              with n or z.

              This command only works on UNIX domain  sockets.   Scan  a  file
              descriptor.   After   issuing  a  FILDES  command  a  subsequent
              rfc2292/bsd4.4 style packet (with at least one dummy  character)
              is  sent  to  clamd  carrying  the file descriptor to be scanned
              inside the ancillary data.  Alternatively  the  file  descriptor
              may be sent in the same packet, including the extra character.

       STATS  IIt  is  mandatory  to newline terminate this command, or prefix
              with n or z, it is recommended to only use the z prefix.

              Replies with statistics about the scan queue, contents  of  scan
              queue,  and  memory  usage. The exact reply format is subject to
              change in future releases.

              It is mandatory to prefix this command with  n  or  z,  and  all
              commands inside IDSESSION must be prefixed.

              Start/end  a  clamd  session.  Within  a  session multiple SCAN,
              INSTREAM, FILDES, VERSION, STATS commands can  be  sent  on  the
              same  socket without opening new connections. Replies from clamd
              will be in the form '<id>: <response>' where <id> is the request
              number  (in  ascii, starting from 1) and <response> is the usual
              clamd reply.   The  reply  lines  have  same  delimiter  as  the
              corresponding  command  had.   Clamd  will  process the commands
              asynchronously, and reply as soon as it has finished processing.

              Clamd requires clients to read all the replies it  sent,  before
              sending   more   commands   to  prevent  send()  deadlocks.  The
              recommended way to implement a client  that  uses  IDSESSION  is
              with  non-blocking sockets, and a select()/poll() loop: whenever
              send would block, sleep in  select/poll  until  either  you  can
              write  more  data,  or  read more replies.  Note that using non-
              blocking sockets without the select/poll  loop  and  alternating
              recv()/send() doesn't comply with clamd's requirements.

              If  clamd  detects  that a client has deadlocked,  it will close
              the  connection.  Note  that  clamd  may  close   an   IDSESSION
              connection  too if you don't follow the protocol's requirements.
              The client can use the  PING  command  to  keep  the  connection

              It  is  mandatory to prefix this command with either n or z.  It
              is recommended to use nVERSIONCOMMANDS.

              Print program and database versions, followed by  "|  COMMANDS:"
              and  a  space-delimited list of supported commands.  Clamd <0.95
              will recognize this as the VERSION command, and reply only  with
              their version, without the commands list.

              This  command  can be used as an easy way to check for IDSESSION
              support for example.


       STREAM Scan stream - on this command clamd will  return  "PORT  number"
              you  should  connect  to and send data to scan. (DEPRECATED, use
              INSTREAM instead)


              Start/end a clamd session which will allow you to  run  multiple
              commands per TCP session. (use IDSESSION instead)


       -h, --help
              Output help information and exit.

       -V, --version
              Print the version number and exit.

       -c FILE, --config-file=FILE
              Read configuration from FILE.


       Clamd recognizes the following signals:

       SIGHUP Reopen the logfile.

              Reload the signature databases.

              Perform a clean exit.




       Please check the full documentation for credits.


       Tomasz Kojm <>


       clamd.conf(5),     clamdscan(1),    freshclam(1),    freshclam.conf(5),