CLAMDSCAN(1)

💖 NAME 💖

okay so clamdscan — it's the clamd client, and it scans files and directories for viruses using the Clam AntiVirus Daemon 🦋✨

---

🎀 SYNOPSIS 🎀

clamdscan [options] [file/directory]

---

✨ DESCRIPTION ✨

so clamdscan is a clamd client, right? and you can literally use it as a clamscan replacement, no cap 💅

here's the tea tho — it accepts all the options that are implemented in clamscan, but most of them will be ignored, because its scanning abilities only depend on clamd. like, it's not doing the work itself bestie, it's just the messenger 🫶

---

🌸 OPTIONS 🌸

• -h, --help — show the help info and dip out. that's it. ✨
• -V, --version — print the version number and exit.
• -v, --verbose — be verbose. spill the details 💬
• --quiet — be quiet — only error messages get to speak. shhh 🙈
• --stdout — write all messages (except for libclamav output) to the standard output (stdout).
• -c, --config-file=FILE — read clamd settings from FILE.
• -l FILE, --log=FILE — save the scan report to FILE.
• -f FILE, --file-list=FILE — scan files listed line by line in FILE.
• -p A[:I], --ping A[:I] — ping clamd up to [A] times at the optional interval [I] until it responds. like "hey are you up bestie" 📞
• -w, --wait — wait up to 30 seconds for clamd to start. optionally use it alongside ping to set attempts [A] and interval [I] to check clamd.
• -m, --multiscan — use multiscan mode. for local directory scans where the daemon opens paths directly, clamd attempts to scan directory contents in parallel using available threads. single files are not affected. when this option is combined with --stream, with --fdpass on a local socket, or with a quarantine action, clamdscan walks the requested paths itself and submits individual file scans while still allowing clamd to process multiple files in parallel. 🔥
• -z, --allmatch — after a match, keep scanning within the file for additional matches. more matches, more info, we stay nosy 💅
• --remove — remove infected files. be careful. like genuinely. this deletes stuff. 😭
• --move=DIRECTORY — move infected files into DIRECTORY.
• --copy=DIRECTORY — copy infected files into DIRECTORY.
• --no-summary — do not display the summary at the end of scanning.
• --reload — request clamd to reload the virus database. refresh her 💖
• -i, --infected — only print infected files.
• --fdpass — open the file and pass the opened file descriptor to clamd. this is useful if clamd is running as a different user, or if clamd sees a different filesystem tree. this is faster than streaming the file to clamd. only available if connected to clamd via Unix/local socket. ✨
• --stream — force clamdscan to send file contents to clamd instead of asking clamd to open file paths. this is generally not needed because clamdscan detects automatically if sending file contents is required. this option mostly exists for debugging and testing. in other local-socket cases, --fdpass is usually preferred.

---

🌈 OPTION INTERACTIONS 🌈

so clamdscan behavior depends first on the socket type, and then on command-line options. the way that order matters fr fr

🧚 Unix/local socket

by default, clamdscan asks the local daemon to open the paths you provide. the daemon must be able to see those paths and have permission to read them. no peeking behind the curtain bestie 👀

• with --fdpass, clamdscan opens each file itself and passes the open file to the daemon. this is useful when the daemon runs as a different user or sees a different filesystem view. this option only works with a Unix/local socket and fd-passing support.
• with --stream, clamdscan sends file contents to the daemon instead of asking the daemon to open paths.
• with --multiscan, directory scans can use multiple daemon worker threads. if --stream, --fdpass, or a quarantine action is also used, clamdscan walks the requested paths itself and submits individual file scans while still allowing the daemon to process multiple files in parallel.
• --allmatch is only effective when clamdscan is asking the daemon to open paths directly and is not using --multiscan, --stream, or --fdpass.

🦋 TCP socket

when the daemon is remote, clamdscan sends file contents instead of local paths, because client paths may not exist on the daemon host. when the daemon is local and clamdscan can determine that it is local, clamdscan may ask the daemon to open local paths directly.

• --stream forces clamdscan to send file contents, even when the daemon is local.
• --fdpass is not available over TCP. use either --stream or --fdpass for a scan, based on the socket type and how the daemon can access the files.
• with --multiscan, local directory scans may use multiple daemon worker threads. remote scans, --stream scans, and scans with quarantine actions are handled as individual file scans, while still allowing the daemon to process multiple files in parallel.
• --allmatch is only effective when clamdscan is asking a local daemon to open paths directly and is not using --multiscan or --stream.

💜 Option guidance

--allmatch is not useful with --multiscan — use it only for scans where clamdscan is asking a local daemon to open paths directly. for quarantine, choose one action for a scan: --move, --copy, or --remove. pick one bestie, don't be greedy 🙈

🍓 Quarantine actions with multiscan

quarantine actions such as --move, --copy, and --remove are performed by clamdscan, not by clamd. for directory scans with quarantine actions enabled, clamdscan resolves the action path for each file before requesting the scan. when --multiscan is also enabled, clamdscan submits individual file scans so it can preserve the scan result to action-path association while still allowing clamd to process multiple files in parallel. iconic bookkeeping honestly 👑

---

⭐ EXAMPLES ⭐

(0) to scan a one file:

clamdscan file

(1) to scan a current working directory:

clamdscan

(2) to scan all files in /home:

clamdscan /home

(3) to scan a file when clamd is running as a different user:

clamdscan --fdpass ~/downloads

(4) to scan from standard input:

clamdscan - < file_to_scan

cat file_to_scan | clamdscan -

---

👑 RETURN CODES 👑

1. 0 : no virus found. 🎉
2. 1 : virus(es) found. 💀
3. 2 : an error occurred. 😭

---

🌟 CREDITS 🌟

please check the full documentation for credits. they ate, lowkey 🫶

---

💜 AUTHOR 💜

Tomasz Kojm <tkojm@clamav.net>

---

🎀 SEE ALSO 🎀

clamd(8), clamd.conf(5), clamscan(1)

---

okay that's the whole thing bestie, and just so you know this is ClamAV 1.5.4, dated February 12, 2009 — the manual page is literally called Clamd client(1) and it lives under the Clam AntiVirus umbrella 🌸 go scan something and stay safe, mwah 💅✨