Ubuntu Manpages

clamdscan

scan files and directories for viruses using Clam AntiVirus Daemon

clamdscan [options] [file/directory]

clamdscan is a clamd client which may be used as a clamscan replacement. It accepts all the options implemented in clamscan but most of them will be ignored because its scanning abilities only depend on clamd.

Display help information and exit.
Print version number and exit.
Be verbose.
Be quiet - only output error messages.
Write all messages (except for libclamav output) to the standard output (stdout).
Read clamd settings from FILE.
Save the scan report to FILE.
Scan files listed line by line in FILE.
Ping clamd up to [A] times at optional interval [I] until it responds.
Wait up to 30 seconds for clamd to start. Optionally use alongside ping to set attempts [A] and interval [I] to check clamd.
Use multiscan mode. For local directory scans where the daemon opens paths directly, clamd attempts to scan directory contents in parallel using available threads. Single files are not affected. When this option is combined with --stream, with --fdpass on a local socket, or with a quarantine action, clamdscan walks the requested paths itself and submits individual file scans while still allowing clamd to process multiple files in parallel.
After a match, continue scanning within the file for additional matches.
Remove infected files. Be careful.
Move infected files into DIRECTORY.
Copy infected files into DIRECTORY.
Do not display summary at the end of scanning.
Request clamd to reload virus database.
Only print infected files
Open the file and pass the opened file descriptor to clamd. This is useful if clamd is running as a different user or if clamd sees a different filesystem tree. This is faster than streaming the file to clamd. Only available if connected to clamd via Unix/local socket.
Force clamdscan to send file contents to clamd instead of asking clamd to open file paths. This is generally not needed because clamdscan detects automatically if sending file contents is required. This option mostly exists for debugging and testing. In other local-socket cases, --fdpass is usually preferred.

clamdscan behavior depends first on the socket type, and then on command-line options.

By default, clamdscan asks the local daemon to open the paths you provide. The daemon must be able to see those paths and have permission to read them.
  • With --fdpass, clamdscan opens each file itself and passes the open file to the daemon. This is useful when the daemon runs as a different user or sees a different filesystem view. This option only works with a Unix/local socket and fd-passing support.
  • With --stream, clamdscan sends file contents to the daemon instead of asking the daemon to open paths.
  • With --multiscan, directory scans can use multiple daemon worker threads. If --stream, --fdpass, or a quarantine action is also used, clamdscan walks the requested paths itself and submits individual file scans while still allowing the daemon to process multiple files in parallel.
  • --allmatch is only effective when clamdscan is asking the daemon to open paths directly and is not using --multiscan, --stream, or --fdpass.
When the daemon is remote, clamdscan sends file contents instead of local paths because client paths may not exist on the daemon host. When the daemon is local and clamdscan can determine that it is local, clamdscan may ask the daemon to open local paths directly.
  • --stream forces clamdscan to send file contents, even when the daemon is local.
  • --fdpass is not available over TCP. Use either --stream or --fdpass for a scan, based on the socket type and how the daemon can access the files.
  • With --multiscan, local directory scans may use multiple daemon worker threads. Remote scans, --stream scans, and scans with quarantine actions are handled as individual file scans, while still allowing the daemon to process multiple files in parallel.
  • --allmatch is only effective when clamdscan is asking a local daemon to open paths directly and is not using --multiscan or --stream.
--allmatch is not useful with --multiscan; use it only for scans where clamdscan is asking a local daemon to open paths directly. For quarantine, choose one action for a scan: --move, --copy, or --remove.
Quarantine actions such as --move, --copy, and --remove are performed by clamdscan, not by clamd. For directory scans with quarantine actions enabled, clamdscan resolves the action path for each file before requesting the scan. When --multiscan is also enabled, clamdscan submits individual file scans so it can preserve the scan result to action-path association while still allowing clamd to process multiple files in parallel.

(0) To scan a one file:

clamdscan file

(1) To scan a current working directory:

clamdscan

(2) To scan all files in /home:

clamdscan /home

(3) To scan a file when clamd is running as a different user:

clamdscan --fdpass ~/downloads

(4) To scan from standard input:

clamdscan - < file_to_scan

cat file_to_scan | clamdscan -

0 : No virus found.

1 : Virus(es) found.
2 : An error occurred.

Please check the full documentation for credits.

Tomasz Kojm <tkojm@clamav.net>

clamd(8), clamd.conf(5), clamscan(1)