Clamd client(1)

NAME

clamdscan - scan files and directories for viruses using Clam AntiVirus Daemon

SYNOPSIS

clamdscan [options] [file/directory]

DESCRIPTION

clamdscan is a clamd client which may be used as a clamscan replacement. It accepts all the options implemented in clamscan but most of them will be ignored because its scanning abilities only depend on clamd.

OPTIONS

-h, --help
    Display help information and exit.

-V, --version
    Print version number and exit.

-v, --verbose
    Be verbose.

--quiet
    Be quiet - only output error messages.

--stdout
    Write all messages (except for libclamav output) to the standard output (stdout).

-c, --config-file=FILE
    Read clamd settings from FILE.

-l FILE, --log=FILE
    Save the scan report to FILE.

-f FILE, --file-list=FILE
    Scan files listed line by line in FILE.

-p A[:I], --ping A[:I]
    Ping clamd up to [A] times at optional interval [I] until it responds.

-w, --wait
    Wait up to 30 seconds for clamd to start. Optionally use alongside ping to set attempts [A] and interval [I] to check clamd.

-m, --multiscan
    Use multiscan mode. For local directory scans where the daemon opens paths directly, clamd attempts to scan directory contents in parallel using available threads. Single files are not affected. When this option is combined with --stream, with --fdpass on a local socket, or with a quarantine action, clamdscan walks the requested paths itself and submits individual file scans while still allowing clamd to process multiple files in parallel.

-z, --allmatch
    After a match, continue scanning within the file for additional matches.

--remove
    Remove infected files. Be careful.

--move=DIRECTORY
    Move infected files into DIRECTORY.

--copy=DIRECTORY
    Copy infected files into DIRECTORY.

--no-summary
    Do not display summary at the end of scanning.

--reload
    Request clamd to reload virus database.

-i, --infected
    Only print infected files

--fdpass
    Open the file and pass the opened file descriptor to clamd. This is useful if clamd is running as a different user or if clamd sees a different filesystem tree. This is faster than streaming the file to clamd. Only available if connected to clamd via Unix/local socket.

--stream
    Force clamdscan to send file contents to clamd instead of asking clamd to open file paths. This is generally not needed because clamdscan detects automatically if sending file contents is required. This option mostly exists for debugging and testing. In other local-socket cases, --fdpass is usually preferred.

OPTION INTERACTIONS

clamdscan behavior depends first on the socket type, and then on command-line options.

Unix/local socket
    By default, clamdscan asks the local daemon to open the paths you provide. The daemon must be able to see those paths and have permission to read them.

    •   With --fdpass, clamdscan opens each file itself and passes the open file to the daemon. This is useful when the daemon runs as a different user or sees a different filesystem view. This option only works with a Unix/local socket and fd-passing support.

    •   With --stream, clamdscan sends file contents to the daemon instead of asking the daemon to open paths.

    •   With --multiscan, directory scans can use multiple daemon worker threads. If --stream, --fdpass, or a quarantine action is also used, clamdscan walks the requested paths itself and submits individual file scans while still allowing the daemon to process multiple files in parallel.

    •   --allmatch is only effective when clamdscan is asking the daemon to open paths directly and is not using --multiscan, --stream, or --fdpass.

TCP socket
    When the daemon is remote, clamdscan sends file contents instead of local paths because client paths may not exist on the daemon host. When the daemon is local and clamdscan can determine that it is local, clamdscan may ask the daemon to open local paths directly.

    •   --stream forces clamdscan to send file contents, even when the daemon is local.

    •   --fdpass is not available over TCP. Use either --stream or --fdpass for a scan, based on the socket type and how the daemon can access the files.

    •   With --multiscan, local directory scans may use multiple daemon worker threads. Remote scans, --stream scans, and scans with quarantine actions are handled as individual file scans, while still allowing the daemon to process multiple files in parallel.

    •   --allmatch is only effective when clamdscan is asking a local daemon to open paths directly and is not using --multiscan or --stream.

Option guidance
    --allmatch is not useful with --multiscan; use it only for scans where clamdscan is asking a local daemon to open paths directly. For quarantine, choose one action for a scan: --move, --copy, or --remove.

Quarantine actions with multiscan
    Quarantine actions such as --move, --copy, and --remove are performed by clamdscan, not by clamd. For directory scans with quarantine actions enabled, clamdscan resolves the action path for each file before requesting the scan. When --multiscan is also enabled, clamdscan submits individual file scans so it can preserve the scan result to action-path association while still allowing clamd to process multiple files in parallel.

EXAMPLES

(0) To scan a one file:
    clamdscan file

(1) To scan a current working directory:
    clamdscan

(2) To scan all files in /home:
    clamdscan /home

(3) To scan a file when clamd is running as a different user:
    clamdscan --fdpass ~/downloads

(4) To scan from standard input:
    clamdscan - < file_to_scan cat file_to_scan | clamdscan -

RETURN CODES

0 : No virus found.

1 : Virus(es) found.

2 : An error occurred.

CREDITS
Please check the full documentation for credits.

AUTHOR

Tomasz Kojm <tkojm@clamav.net>

SEE ALSO

clamd(8), clamd.conf(5), clamscan(1)